CVE Watch14 oct 2026

CVE-2026-48156

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which lead

CVSS

3.3

Bajo

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 28 may 2026 · Última mod.: 14 oct 2026 · CWE-834

EPSS · 30d

0.1%EPSS · 30 días0.2%

2026-09-262026-10-25

Descripción técnica

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-115580—

34.9%

——10pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.2d CVE-2026-90798—

48.2%

——14A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.5d CVE-2026-1105965.5 MED

5.5%

——2quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images.6d CVE-2026-1092996.5 MED

31.3%

——9Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.2d CVE-2026-1065765.3 MED

36.6%

——11ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version 7.1.2-31.17d CVE-2026-91137—

20.0%

——6Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.23d