HIGH: org.verapdf:validation-model — veraPDF Validation XXE via Rich Text
Summary Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious…
Source org.verapdf:validation-modelPublished 6d ago · Jul 29, 2026Posted on Threads
What we hold
- Package
- org.verapdf:validation-model
- Ecosystem
- maven
- Severity
- HIGH
- ID
- CVE-2026-54078
Summary Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious…
More like this
HIGH: undici — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly…
HIGH: fast-uri — fast-uri vulnerable to host confusion via backslash authority introducer
Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything…
CRITICAL: @nocobase/plugin-notification-in-app-message — NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal() template string with no escape, type cast, or parameter…