Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

2,990 results · page 14 of 60

Jul 6, 2025Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability.CVE-2025-53181 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Jul 6, 2025Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability.CVE-2025-53180 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Jul 6, 2025Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability.CVE-2025-53179 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function stability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Jul 4, 2025CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow.CVE-2025-48172 · Other software · CHMLib · reported by MITREMedium 5.6
CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes.
Product
CHMLib
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com drive.google.com
Jul 2, 2025Poppler is a PDF rendering library.CVE-2025-52886 · Other software · poppler · reported by GitHubMedium 5.5
Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.
Product
poppler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.freedesktop.org gitlab.freedesktop.org
Jul 2, 2025In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages CVE-2025-6725 · Other software · Progress Software · reported by security@progress.comMedium 5.4
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
Product
Kendo UI for jQuery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record telerik.com telerik.com
Jul 1, 2025Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: DOM-Based Reflected Cross-Site ScriptingCVE-2025-5314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
Affected
up to 2.3.65
What to do
Affects up to 2.3.65. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2025WooCommerce PDF Invoice Builder: Cross-Site Request Forgery (CSRF)CVE-2025-53203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Cross Site Request Forgery.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.148.
Product
WooCommerce PDF Invoice Builder
Affected
up to 1.2.148
What to do
Affects up to 1.2.148. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6662 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26985.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor App Object Use-After-Free Remote Code Execution Vulnerability.CVE-2025-6661 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor App Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of App objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26823.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor GIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2025-6660 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor GIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26763.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-6659 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26734.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6658 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26733.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6657 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26732.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6656 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26731.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6655 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26730.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-6654 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26729.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6653 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26726.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6652 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26724.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-6651 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26713.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6650 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26712.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6649 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26709.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6648 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26671.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-6647 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26644.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability.CVE-2025-6646 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26643.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2025-6645 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26642.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2025-6644 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26536.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6643 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26532.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability.CVE-2025-6642 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26530.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability.CVE-2025-6641 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comLow 3.3
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26528.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 25, 2025PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability.CVE-2025-6640 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26527.
Product
PDF-XChange Editor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pdf-xchange.com zerodayinitiative.com
Jun 21, 20253D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery: Stored Cross-Site ScriptingCVE-2025-5289 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.
Product
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
Affected
up to 1.16.15
What to do
Affects up to 1.16.15. Update 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2025A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of CVE-2025-20260 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device. This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
Product
ClamAV
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.clamav.net lists.debian.org
Jun 16, 2025An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF filCVE-2025-2091 · Other software · M-Files Corporation · reported by security@m-files.comMedium 4.8
An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs.
Product
M-Files Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record empower.m-files.com product.m-files.com
Jun 11, 2025A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without promptinCVE-2025-5986 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 6, 2025PDF for WPForms: Missing AuthorizationCVE-2025-49289 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.5.0.
Product
PDF for WPForms
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 29, 2025An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php componentCVE-2024-51392 · Other software · reported by MITREHigh 8.8
An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 22, 2025An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary codeCVE-2025-5099 · Other software · Mobile Dynamix · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9Critical 9.8
An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution.
Product
PrinterShare Mobile Print
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record korelogic.com korelogic.com
May 15, 2025Save as Image Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2024-3062 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Save as Image Plugin by Pdfcrowd
Fixed in
3.2.2
What to do
Update Save as Image Plugin by Pdfcrowd to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 7, 2025PDF Invoice Builder for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47537 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows SQL Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 5.3.8.
Product
PDF Invoice Builder for WooCommerce
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 1, 2025Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files.CVE-2025-46568 · Other software · Stirling-Tools · reported by GitHubHigh 7.7
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references to several files inside, allow the attachment of content from any webpage or local file to a PDF. This allows the attacker to read any file on the server, including sensitive files and configuration files. All users utilizing this feature will be affected. This issue has been patched in version 0.45.0.
Product
Stirling-PDF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 27, 2025Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.CVE-2025-2866 · Other software · The Document Foundation · reported by security@documentfoundation.orgLow 2.4
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
Product
LibreOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record libreoffice.org lists.debian.org
Apr 17, 2025WP Post to PDF Enhanced: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39427 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beth Tucker Long WP Post to PDF Enhanced wp-post-to-pdf-enhanced allows Stored XSS.This issue affects WP Post to PDF Enhanced: from n/a through <= 1.1.1.
Product
WP Post to PDF Enhanced
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Post to PDF Enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025PDF 2 Post: Improper Control of Generation of Code ('Code Injection')CVE-2025-32583 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in termel PDF 2 Post pdf2post allows Remote Code Inclusion.This issue affects PDF 2 Post: from n/a through <= 2.4.0.
Product
PDF 2 Post
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update PDF 2 Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability.CVE-2025-1656 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Product
Revit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Apr 15, 2025A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability.CVE-2025-1277 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Product
Revit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Apr 15, 2025A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability.CVE-2025-1273 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Product
Revit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Apr 2, 2025Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid VerticesPerRow value in a PDF shading dictionary.CVE-2025-3154 · Other software · Xpdf · reported by xpdf@xpdfreader.comLow 2.1
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid VerticesPerRow value in a PDF shading dictionary.
Product
Xpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record xpdfreader.com
Apr 1, 2025PDF Generator Addon for Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31850 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder pdf-generator-addon-for-elementor-page-builder allows Stored XSS.This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through <= 2.1.0.
Product
PDF Generator Addon for Elementor Page Builder
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update PDF Generator Addon for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Print PDF Generator and Publisher: Cross-Site Request Forgery (CSRF)CVE-2025-22637 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in verkkovaraani Print PDF Generator and Publisher nopeamedia allows Cross Site Request Forgery.This issue affects Print PDF Generator and Publisher: from n/a through <= 1.2.0.
Product
Print PDF Generator and Publisher
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Print PDF Generator and Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.