Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9 results
Oct 14, 2026xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescapeCVE-2026-110642 · Other software · xhtml2pdf · reported by VulnCheckHigh 8.5
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
- Product
- xhtml2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10.CVE-2025-56590 · Other software · Apryse · reported by MITRECritical 9.8
An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary operating system commands on the local server.
- Product
- Html2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK CVE-2025-56589 · Other software · Apryse · reported by MITREHigh 7.5
A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0. These vulnerabilities could allow an attacker to read local files on the server or make arbitrary HTTP requests to internal or external services. Both vulnerabilities could lead to the disclosure of sensitive data or potential system takeover.
- Product
- Html2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstratascale.comstratascale.com
Jan 14, 2026html2pdf.js converts any webpage or element into a printable PDF entirely client-side.CVE-2026-22787 · Other software · eKoopmans · reported by GitHubHigh 8.7
html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts to be run on the client browser and risking the confidentiality, integrity, and availability of the page's data. This vulnerability has been fixed in html2pdf.js@0.14.0.
- Product
- html2pdf.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafCVE-2024-25885 · Other software · xhtml2pdf · reported by MITREHigh 7.5
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
- Product
- xhtml2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files.CVE-2024-1647 · Other software · pyhtml2pdf · reported by help@fluidattacks.comHigh 7.5
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.
- Product
- pyhtml2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.compypi.org
Aug 28, 2023Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.CVE-2023-39062 · Other software · Html2pdf Project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
- Product
- Html2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022An issue was discovered in Spipu HTML2PDF before 5.2.4.CVE-2021-45394 · Other software · Html2pdf Project · reported by MITREHigh 8.8
An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.
- Product
- Html2pdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users.CVE-2020-28031 · Other software · Eramba · reported by MITREMedium 4.3
eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users.
- Product
- Eramba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscussions.eramba.orgeramba.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.