Stefan

19 exploits Active since Jun 2023
CVE-2026-24688 WRITEUP MEDIUM WRITEUP
pypdf < 6.6.2 - Denial of Service via Infinite Loop in Outline Processing
pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.
CVSS 4.3
CVE-2026-41168 WRITEUP MEDIUM WRITEUP
pypdf has possible long runtimes for wrong size values in cross-reference and object streams
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.
CVSS 5.3
CVE-2026-41313 WRITEUP MEDIUM WRITEUP
pypdf: Possible long runtimes for wrong size values in incremental mode
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.
CVSS 6.5
CVE-2026-41312 WRITEUP MEDIUM WRITEUP
pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.
CVSS 6.5
CVE-2026-41314 WRITEUP MEDIUM WRITEUP
pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.
CVSS 6.5
CVE-2026-40260 WRITEUP MEDIUM WRITEUP
pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.
CVSS 5.3
CVE-2026-28804 WRITEUP MEDIUM WRITEUP
pypdf < 6.7.5 - Denial of Service via ASCIIHexDecode Filter
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.
CVSS 5.3
CVE-2026-28351 WRITEUP MEDIUM WRITEUP
pypdf < 6.7.4 - Uncontrolled Resource Consumption via RunLengthDecode Filter
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.
CVSS 5.3
CVE-2026-27888 WRITEUP HIGH WRITEUP
pypdf < 6.7.3 - Denial of Service via XFA Property with FlateDecode Compression
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.
CVSS 7.5
CVE-2026-27024 WRITEUP MEDIUM WRITEUP
pypdf < 6.7.1 - Denial of Service via Infinite Loop in TreeObject Children Access
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires accessing the children of a TreeObject, for example as part of outlines. This vulnerability is fixed in 6.7.1.
CVSS 5.5
CVE-2026-27025 WRITEUP MEDIUM WRITEUP
pypdf < 6.7.1 - Denial of Service via Malicious /ToUnicode Font Entry
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.
CVSS 5.5
CVE-2026-27026 WRITEUP MEDIUM WRITEUP
pypdf < 6.7.1 - Denial of Service via Malformed FlateDecode Stream
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.
CVSS 5.5
CVE-2018-25086 WRITEUP LOW WRITEUP
FanPress CM 3.6.0-3.6.3 - Cross-Site Scripting in Template Preview
A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.6.4 is able to address this issue. The patch is named c380d343c2107fcee55ab00eb8d189ce5e03369b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230235.
CVSS 3.5
CVE-2025-62707 WRITEUP HIGH WRITEUP
pypdf < 6.1.3 - Denial of Service via DCTDecode Inline Image Parsing
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3.
CVSS 7.5
CVE-2025-62708 WRITEUP HIGH WRITEUP
pypdf < 6.1.3 - Denial of Service via LZWDecode Filter
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3.
CVSS 7.5
CVE-2025-66019 WRITEUP MEDIUM WRITEUP
pypdf < 6.4.0 - Uncontrolled Resource Consumption via LZWDecode Filter
pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patched in version 6.4.0.
CVE-2026-22690 WRITEUP MEDIUM WRITEUP
pypdf < 6.6.0 - Uncontrolled Resource Consumption via Missing /Root Object
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.
CVSS 5.3
CVE-2026-22691 WRITEUP MEDIUM WRITEUP
pypdf < 6.6.0 - Denial of Service via Malformed startxref Processing
pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.
CVSS 5.3
EIP-2026-118039 EXPLOITDB c WORKING POC
UltraISO 9.3.6.2750 - Local Buffer Overflow