Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Aug 19, 2026phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF.CVE-2026-76210 · Other software · thorsten · reported by VulnCheckHigh 7.1
phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an <img> tag whose src references a local file under the web root's content/ directory (e.g., content/core/config/database.php). When the PDF is generated, phpMyFAQ attempts to read the referenced file; because it is not a valid image the resulting error is converted into an uncaught exception whose stack trace discloses part of the file's contents to any user who triggers the PDF export. By default the disclosed portion is truncated (zend.exception_string_param_max_len), but a larger configured value can result in disclosure of entire files, including database credentials.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jan 8, 2025cpdf through 2.8 allows stack consumption via a crafted PDF document.CVE-2024-54731 · Other software · Coherent Graphics · reported by MITREMedium 4
cpdf through 2.8 allows stack consumption via a crafted PDF document.
- Product
- CPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2024An issue was discovered in TCPDF before 6.8.0.CVE-2024-56527 · Other software · tecnick · reported by MITREHigh 7.5
An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandrea0.medium.comgithub.com
Dec 27, 2024An issue was discovered in TCPDF before 6.8.0.CVE-2024-56522 · Other software · tecnick · reported by MITREHigh 7.5
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2024An issue was discovered in TCPDF before 6.8.0.CVE-2024-56521 · Other software · tecnick · reported by MITRECritical 9.8
An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2024An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products.CVE-2024-56520 · Other software · tecnick · reported by MITREHigh 7.3
An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2024An issue was discovered in TCPDF before 6.8.0.CVE-2024-56519 · Other software · tecnick · reported by MITREHigh 7.5
An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2024Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5.CVE-2024-51058 · Other software · tcpdf_project · reported by MITREMedium 6.2
Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through <img> src tag, potentially exposing sensitive information.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2024TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.CVE-2024-22641 · Other software · tcpdf_project · reported by MITREHigh 7.5
TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.CVE-2024-22640 · Other software · tcpdf_project · reported by MITREHigh 7.5
TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024TCPDF before 6.7.4 mishandles calls that use HTML syntax.CVE-2024-32489 · Other software · tcpdf_project · reported by MITREMedium 6.1
TCPDF before 6.7.4 mishandles calls that use HTML syntax.
- Product
- tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does CVE-2022-30351 · Other software · Pdfzorro · reported by MITREHigh 7.5
PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does not properly sanitize this information in all cases, causing redacted information, including images and text embedded in the PDF file, to be leaked unintentionally. In cases where PDF text objects are present it is possible to copy-paste redacted information into the system clipboard. Once a document is "locked" and marked for redaction once, all redactions performed after this feature is triggered are vulnerable.
- Product
- Pdfzorro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2021Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or aCVE-2018-20311 · Other software · Foxitsoftware · reported by MITREHigh 8.1
Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
- Product
- Phantompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfoxitsoftware.comfoxitsoftware.com
Dec 15, 2020In CPDF_RenderStatus::LoadSMask of cpdf_renderstatus.cpp, there is a possible memory corruption due to a use-after free.CVE-2020-0496 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In CPDF_RenderStatus::LoadSMask of cpdf_renderstatus.cpp, there is a possible memory corruption due to a use-after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-149481220
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2020In CPDF_SampledFunc::v_Call of cpdf_sampledfunc.cpp, there is a possible out of bounds read due to improper input validation.CVE-2020-0493 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In CPDF_SampledFunc::v_Call of cpdf_sampledfunc.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150615407
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 2, 2020Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API.CVE-2020-14425 · Other software · Foxitsoftware · reported by MITREHigh 7.8
Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 14, 2018An issue was discovered in TCPDF before 6.2.22.CVE-2018-17057 · Other software · Tecnick · reported by MITRECritical 9.8
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
- Product
- Tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 23, 2017tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.CVE-2017-6100 · Other software · Tcpdf Project · reported by MITREHigh 7.5
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
- Product
- Tcpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.debian.org
Jun 5, 2016The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishanCVE-2016-1686 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, mishandles decoder-initialization failure, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comlists.opensuse.org
Oct 15, 2015The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly pCVE-2015-6758 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comrhn.redhat.com
Oct 15, 2015Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, allows CVE-2015-6756 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.8
Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused annotation in a PDF document.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comrhn.redhat.com
Nov 19, 2014Use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in fpdfapi/fpdf_parser/fpdf_parser_parser.cpp in PDFium, as used in Google Chrome befCVE-2014-7900 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
Use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in fpdfapi/fpdf_parser/fpdf_parser_parser.cpp in PDFium, as used in Google Chrome before 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comsecurityfocus.com
Mar 12, 2007The cpdf_open function in the ClibPDF (cpdf) extension in PHP 4.4.6 allows context-dependent attackers to obtain sensitive information (script source code) via CVE-2007-1412 · Websites & servers · PHP · reported by MITREHigh 7.8
The cpdf_open function in the ClibPDF (cpdf) extension in PHP 4.4.6 allows context-dependent attackers to obtain sensitive information (script source code) via a long string in the second argument.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.