CVE-2026-105481

nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nodejs

Products

Nodejs

CVE-2026-104597

libosmocore: libosmocore: Information disclosure via out-of-bounds read in iuup_rx_initialization

libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-102786

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-113795

pypdf: Possible large memory usage for streams with multiple filters

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-113794

pypdf: Possible infinite loop when hitting EOF in standard xref table

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-113789

pypdf: Possible long runtimes/large memory usage when retrieving form fields

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-50053

Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters

A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Synacor Zimbra

Products

Zimbra Collaboration Suite Zimbra Collaboration Suite

CVE-2026-33123

pypdf has inefficient decoding of array-based streams

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-28351

Manipulated RunLengthDecode streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying the changes from PR #3664.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-33699

pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-27888

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.3, an attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires accessing the `xfa` property of a reader or writer and the corresponding stream being compressed using `/FlateDecode`. This has been fixed in pypdf 6.7.3. As a workaround, apply the patch manually.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-71870

pypdf: Possible large memory usage for large /ToUnicode streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in 6.15.0.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-27628

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may apply the patch manually.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-41314

pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-24688

pypdf has possible Infinite Loop when processing outlines/bookmarks

pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-41313

pypdf: Possible long runtimes for wrong size values in incremental mode

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-41312

pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-31826

pypdf: manipulated stream length values can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-49460

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf

CVE-2026-54651

pypdf: Possible infinite loop when processing threads/articles in writer

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Py-pdf

Products

Pypdf