Total
10460 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-91810 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 6.1 MEDIUM |
| A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash. | |||||
| CVE-2026-91812 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.9 HIGH |
| A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges. | |||||
| CVE-2026-91813 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 8.8 HIGH |
| A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges. | |||||
| CVE-2026-91815 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution. | |||||
| CVE-2026-91816 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash. | |||||
| CVE-2026-91818 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash. | |||||
| CVE-2026-91804 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes. | |||||
| CVE-2026-91802 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash. | |||||
| CVE-2026-91801 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution. | |||||
| CVE-2026-91808 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 6.1 MEDIUM |
| A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash. | |||||
| CVE-2026-91799 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution. | |||||
| CVE-2026-91797 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened. | |||||
| CVE-2026-91796 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 6.1 MEDIUM |
| The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials. | |||||
| CVE-2026-91795 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution. | |||||
| CVE-2026-91793 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash. | |||||
| CVE-2026-91792 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-10-08 | N/A | 7.8 HIGH |
| When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash. | |||||
| CVE-2025-2140 | 3 Ibm, Linux, Microsoft | 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more | 2026-10-08 | N/A | 5.7 MEDIUM |
| IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data. | |||||
| CVE-2025-2139 | 3 Ibm, Linux, Microsoft | 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more | 2026-10-08 | N/A | 3.5 LOW |
| IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security. | |||||
| CVE-2025-2138 | 3 Ibm, Linux, Microsoft | 4 Aix, Engineering Requirements Management Doors Next, Linux Kernel and 1 more | 2026-10-08 | N/A | 3.5 LOW |
| IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security. | |||||
| CVE-2025-61787 | 2 Deno, Microsoft | 2 Deno, Windows | 2026-10-08 | N/A | 8.1 HIGH |
| Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue. | |||||