Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,990 results · page 9 of 60
Apr 1, 2026PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices.CVE-2026-34376 · Other software · mrmn2 · reported by GitHubHigh 7.5
PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulnerability allows unauthenticated users to retrieve password-protected shared PDFs by directly calling the file-serving endpoint without completing the password verification flow. This results in unauthorized access to confidential documents that users expected to be protected by a shared-link password. This issue has been patched in version 1.7.0.
- Product
- PdfDing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal files via the file impCVE-2026-30292 · Other software · reported by MITREHigh 8.4
An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocudepot.bitbucket.iogithub.com
Apr 1, 2026An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical internal files via the fileCVE-2026-30291 · Other software · reported by MITREHigh 8.4
An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comoratools.github.io
Apr 1, 2026An arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to overwrite critical internal files via thCVE-2026-30287 · Other software · Deepthought.industries · reported by MITREHigh 8.4
An arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- Product
- ACE Scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeepthought.industriesgithub.com
Apr 1, 2026Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.CVE-2026-5287 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Mar 31, 2026The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable dCVE-2026-3780 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.3
The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable directories, allowing a local attacker to place malicious binaries with the same names and have them loaded or executed instead of the legitimate system files, resulting in local privilege escalation.
- Product
- Foxit PDF Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documCVE-2026-3779 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxit.comtalosintelligence.com
Mar 31, 2026The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF.CVE-2026-3778 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.2
The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that reference each other in a loop, passing the document to APIs (e.g., SOAP) that perform deep traversal can cause uncontrolled recursion, stack exhaustion, and application crashes.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state.CVE-2026-3777 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.5
The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state. When a script modifies the zoom property and then triggers a page change, the original view object may be destroyed while stale pointers are still kept and later dereferenced, which under crafted JavaScript and document structures can lead to a use-after-free condition and potentially allow arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources.CVE-2026-3776 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.5
The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a crafted document to trigger a null pointer dereference and crash the application, resulting in denial of service.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileCVE-2026-3775 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these libraries may be resolved and loaded from user‑writable locations, a local attacker can place a malicious library there and have it loaded with SYSTEM privileges, resulting in local privilege escalation and arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCCVE-2026-3774 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 4.7
The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (OCGs) immediately before or after redaction, encryption, or printing. These script‑driven updates are not fully covered by the existing redaction, encryption, and printing logic, which, under specific document structures and user workflows, may cause a small amount of sensitive content to remain unremoved or unencrypted as expected, or result in printed output that slightly differs from what was reviewed on screen.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices.CVE-2026-34586 · Other software · mrmn2 · reported by GitHubMedium 6.5
PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, check_shared_access_allowed() validates only session existence — it does not check SharedPdf.inactive (expiration / max views) or SharedPdf.deleted. The Serve and Download endpoints rely solely on this function, allowing previously-authorized users to access shared PDF content after expiration, view limit, or soft-deletion. This issue has been patched in version 1.7.1.
- Product
- PdfDing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An arbitrary file overwrite vulnerability in PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001 allows attackers to overwrite critical internal files via the fCVE-2026-30277 · Other software · Triumph-adler · reported by MITREHigh 8.4
An arbitrary file overwrite vulnerability in PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- Product
- Mobile Print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecsys.fudan.edu.cn
Mar 31, 2026An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import processCVE-2026-30276 · Other software · Deftpdf · reported by MITRECritical 9.8
An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
- Product
- Document Translator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer oCVE-2026-3308 · Other software · Artifex Software Inc. *PyMuPDF* · reported by cret@cert.orgHigh 7.8
An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code execution.
- Product
- MuPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.ghostscript.comgithub.com
Mar 26, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-33699 · Other software · py-pdf · reported by GitHubMedium 4.6
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files.CVE-2026-34071 · Other software · Stirling-Tools · reported by GitHubMedium 5.4
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.
- Product
- Stirling-PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files.CVE-2026-33438 · Other software · Stirling-Tools · reported by GitHubMedium 6.5
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Versions starting in 2.1.5 and prior to 2.5.2 have Denial of Service (DoS) vulnerability in the Stirling-PDF watermark functionality (`/api/v1/security/add-watermark` endpoint). The vulnerability allows authenticated users to cause resource exhaustion and server crashes by providing extreme values for the `fontSize` and `widthSpacer` parameters. Version 2.5.2 patches the issue.
- Product
- Stirling-PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026PDF Explorer 1.5.66.2 contains a structured exception handler (SEH) overflow vulnerability that allows local attackers to execute arbitrary code by overwriting CVE-2018-25217 · Other software · Rttsoftware · reported by VulnCheckHigh 8.6
PDF Explorer 1.5.66.2 contains a structured exception handler (SEH) overflow vulnerability that allows local attackers to execute arbitrary code by overwriting SEH records with malicious data. Attackers can craft a payload with buffer overflow, NSEH jump, and ROP gadget chains that execute when the Custom fields settings dialog processes the malicious input in the Label field.
- Product
- PDF Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrttsoftware.comexploit-db.com
Mar 25, 2026pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter.CVE-2026-26830 · Other software · Pdf-image Project · reported by MITRECritical 9.8
pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()
- Product
- Pdf-image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026PeproDev Ultimate Invoice: Has a bulk download invoices action that generates ZIP archives containing exported invoice PDFsCVE-2026-2343 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.
- Product
- PeproDev Ultimate Invoice
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 21, 2026Encrypt PDF 2.3 contains a buffer overflow vulnerability that allows local attackers to crash the application by inputting excessively long strings into passworCVE-2019-25550 · Other software · Verypdf · reported by VulnCheckMedium 6.9
Encrypt PDF 2.3 contains a buffer overflow vulnerability that allows local attackers to crash the application by inputting excessively long strings into password fields. Attackers can paste a 1000-byte buffer into the User Password or Master Password field in the Settings dialog to trigger an application crash when importing PDF files.
- Product
- Encrypt PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordverypdf.comexploit-db.com
Mar 21, 2026VeryPDF PCL Converter 2.7 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long passwCVE-2019-25549 · Other software · Verypdf · reported by VulnCheckMedium 6.9
VeryPDF PCL Converter 2.7 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long password string. Attackers can trigger a buffer overflow by entering a 3000-byte password in the PDF Security encryption fields, causing the application to crash when processing PCL files.
- Product
- VeryPDF PCL Converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordverypdf.comexploit-db.com
Mar 20, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-33123 · Other software · py-pdf · reported by GitHubMedium 5.1
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Stirling-PDF is a locally hosted web application that performs various operations on PDF files.CVE-2026-27625 · Other software · Stirling-Tools · reported by GitHubHigh 8.1
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (stirlingpdfuser). This can overwrite writable files and compromise data integrity, with further impact depending on writable paths. The issue was fixed in version 2.5.2.
- Product
- Stirling-PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Heap buffer overflow in PDFium in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.CVE-2026-4455 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Mar 19, 2026A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.CVE-2026-3029 · Other software · Artifex Software Inc. *PyMuPDF* · reported by cret@cert.orgHigh 7.5
A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPDF version, 1.26.5.
- Product
- PyMuPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.CVE-2026-4407 · Other software · Xpdf · reported by xpdf@xpdfreader.comLow 2.1
Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.
- Product
- Xpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-31938 · Other software · parallax · reported by GitHubCritical 9.6
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf@4.2.1. As a workaround, sanitize user input before passing it to the output method.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026jsPDF is a library to generate PDFs in JavaScript.CVE-2026-31898 · Other software · parallax · reported by GitHubHigh 8.1
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.
- Product
- jsPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026e2pdf: Missing AuthorizationCVE-2026-32442 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.
- Product
- e2pdf
- Affected
- up to 1.28.15
- What to do
- Affects up to 1.28.15. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026PDF Poster: Missing AuthorizationCVE-2026-32416 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Poster: from n/a through <= 2.4.0.
- Product
- PDF Poster
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update PDF Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Embed PDF Viewer: Server-Side Request Forgery (SSRF)CVE-2026-32349 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer allows Server Side Request Forgery.This issue affects Embed PDF Viewer: from n/a through <= 2.4.7.
- Product
- Embed PDF Viewer
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update Embed PDF Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2026Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF filCVE-2026-3939 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.3
Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF file. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Mar 11, 2026Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafCVE-2026-3932 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Mar 11, 2026Verypdf docPrint Pro 8.0 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplyiCVE-2019-25467 · Other software · Verypdf · reported by VulnCheckHigh 8.6
Verypdf docPrint Pro 8.0 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized alphanumeric encoded payload in the User Password or Master Password fields. Attackers can craft a malicious payload with encoded shellcode and SEH chain manipulation to bypass protections and execute a MessageBox proof-of-concept when the password fields are processed during PDF encryption.
- Product
- docPrint Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.verypdf.netverypdf.com
Mar 10, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-2569 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PDF page labels in all versions up to, and including, 2.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
- Affected
- up to 2.4.20
- What to do
- Affects up to 2.4.20. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 10, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-31826 · Other software · py-pdf · reported by GitHubMedium 6.8
pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via theCVE-2026-26801 · Other software · Pdfmake · reported by MITREHigh 7.5
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.
- Product
- Pdfmake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.CVE-2026-23907 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path. Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
- Product
- Apache PDFBox Examples
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Mar 6, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-28804 · Other software · py-pdf · reported by GitHubMedium 6.9
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2026SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.CVE-2026-27441 · Other software · SEPPmail · reported by vulnerability@ncsc.chCritical 9.5
SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.
- Product
- Secure Email Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.seppmail.com
Feb 27, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-28351 · Other software · py-pdf · reported by GitHubMedium 6.9
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-27888 · Other software · py-pdf · reported by GitHubMedium 6.6
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-27628 · Other software · py-pdf · reported by GitHubLow 1.2
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.CVE-2026-2040 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.3
PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of PDF-XChange Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the TrackerUpdate process. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of a target user. Was ZDI-CAN-27788.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-27026 · Other software · py-pdf · reported by GitHubMedium 6.9
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-27025 · Other software · py-pdf · reported by GitHubMedium 6.9
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026pypdf is a free and open-source pure-python PDF library.CVE-2026-27024 · Other software · py-pdf · reported by GitHubMedium 6.9
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.
- Product
- pypdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.