Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,990 results · page 3 of 60
Sep 24, 2026BentoPDF is a client-side PDF toolkit that is self hostable.CVE-2026-63630 · Other software · alam00000 · reported by GitHubLow 3.4
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.
- Product
- bentopdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation.CVE-2026-88916 · Other software · TÜBİTAK ULAKBİM · reported by iletisim@usom.gov.trMedium 6.8
Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026.
- Product
- UlakPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass.CVE-2026-88907 · Other software · TÜBİTAK ULAKBİM · reported by iletisim@usom.gov.trHigh 7.4
Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026.
- Product
- UlakPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations.CVE-2026-91818 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript.CVE-2026-91817 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.1
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations.CVE-2026-91816 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap CVE-2026-91815 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents.CVE-2026-91814 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 5.3
A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insuCVE-2026-91813 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 8.8
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, CVE-2026-91812 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.9
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fanCVE-2026-91811 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks.CVE-2026-91810 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.1
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields.CVE-2026-91809 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata.CVE-2026-91808 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.1
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data.CVE-2026-91807 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.1
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields.CVE-2026-91806 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling.CVE-2026-91805 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in sCVE-2026-91804 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writableCVE-2026-91803 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 8.8
A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffCVE-2026-91802 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources.CVE-2026-91801 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuratiCVE-2026-91800 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 8.8
A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects.CVE-2026-91799 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the coCVE-2026-91798 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 8.8
A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be writtenCVE-2026-91797 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB CVE-2026-91796 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 6.1
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files.CVE-2026-91795 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation whenCVE-2026-91794 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data.CVE-2026-91793 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScripCVE-2026-91792 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibCVE-2026-91791 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed.CVE-2026-91790 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information.CVE-2026-91789 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. Under certain conditions, this could lead to an incorrectly sized memory allocation and a subsequent out-of-bounds write during pixel processing, potentially resulting in remote code execution.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification.CVE-2026-91788 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2Medium 4.7
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents.CVE-2026-63276 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 5.4
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026LibreOffice Draw can import PDF documents.CVE-2026-63274 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 5.4
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026LibreOffice Draw can import PDF documents.CVE-2026-63273 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 5.4
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer wrote past its end. In fixed versions a declared key length larger than the buffer is rejected.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2026PDF Builder for WooCommerce. Create invoices,packing slips and more: Authorization bypassCVE-2026-11899 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.
- Product
- PDF Builder for WooCommerce. Create invoices,packing slips and more
- Affected
- up to 2.0.11
- What to do
- Affects up to 2.0.11. Update PDF Builder for WooCommerce. Create invoices,packing slips and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Save as PDF Plugin by PDFCrowd: Arbitrary Function InvocationCVE-2026-92807 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`button_`/non-`email_` shortcode attribute verbatim into a custom options array without sanitization, allowlist enforcement, or capability checks, and `create_button()` AES-encrypts that array — including the attacker-supplied callback value — and embeds the resulting blob in the rendered button HTML; when the blob is later POSTed to the unauthenticated `wp_ajax_nopriv_save_as_pdf_pdfcrowd` endpoint, `save_as_pdf_pdfcrowd()` decrypts it and invokes `$options['pdf_created_callback']` as a PHP callable at line 1722 with no `is_callable()` guard, no allowlist, and no capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to invoke arbitrary PHP functions or static class methods with plugin option data as the sole argument, enabling disclosure of the site's stored PDFCrowd API key and username or further server-side abuse. Note that the encryption boundary does not mitigate this vector bec
- Product
- Save as PDF Plugin by PDFCrowd
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update Save as PDF Plugin by PDFCrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications.CVE-2026-91127 · Other software · flyfish-dev · reported by GitHubHigh 8.2
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes. A crafted legacy DOC file could place javascript:, vbscript:, data:, or another unsafe scheme in a rendered link, and script could execute in the embedding application's origin when a user clicked the link. The fix blocks external document links by default, allows only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks when external links are explicitly enabled, and applies mount-boundary sanitization as defense in depth. This issue is fixed in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.
- Product
- file-viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents: Reflected Cross-Site ScriptingCVE-2026-89330 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is a regression: the esc_url() wrapper that remediated the equivalent CVE-2023-5749 in version 3.9.2 was removed in version 4.3.0 during a refactor that introduced the 'unique' parameter.
- Product
- EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
- Affected
- up to 4.6.5
- What to do
- Affects up to 4.6.5. Update EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Generate PDF using Contact Form 7: Does not restrict the destination of the image fetch its PDF renderer performs on submitted form contentCVE-2026-90984 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.
- Product
- Generate PDF using Contact Form 7
- Fixed in
- 4.2.2
- What to do
- Update Generate PDF using Contact Form 7 to 4.2.2 or newer.
Sep 17, 2026PoDoFo is a C++17 PDF manipulation library.CVE-2026-54633 · Other software · podofo · reported by GitHubMedium 6.9
PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. PdfColorSpaceFilterFactory::TryCreateFromObject also validates hival with an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range. The resulting read can disclose adjacent heap data or crash the processing application. This issue is fixed in version 1.1.1.
- Product
- podofo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.CVE-2026-93382 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 17, 2026Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute aCVE-2026-93381 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 17, 2026`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants.CVE-2026-68537 · Other software · fulgur-rs · reported by GitHubHigh 7.5
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
- Product
- fulgur
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants.CVE-2026-68523 · Other software · fulgur-rs · reported by GitHubHigh 7.5
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
- Product
- fulgur
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9.CVE-2026-92413 · Other software · Artifex · reported by VulDBLow 2.1
A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 3df1e30f9d7b77260e13bd0dbe1928ddeba8386e. Applying a patch is advised to resolve this issue.
- Product
- MuPDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordartifex.combugs.ghostscript.com
Sep 15, 2026Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.CVE-2026-91737 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Sep 15, 2026pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability.CVE-2026-92180 · Other software · pdfforge · reported by zdi-disclosures@trendmicro.comHigh 7.8
pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the activation-service process. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-29536.
- Product
- PDF Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.