{"items":[{"id":"CVE-2026-90943","published":"2026-09-14T15:37:31.329Z","updated":"2026-09-14T20:07:01.726Z","title":"parallax filament-comments through 3.0.0 Stored XSS via Comment Body","severity":"CRITICAL","score":9.3,"vendor":"parallax","product":"filament-comments","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-31938","published":"2026-03-18T03:05:44.964Z","updated":"2026-09-07T12:04:46.902Z","title":"jsPDF has HTML Injection in New Window paths","severity":"CRITICAL","score":9.6,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.0028,"kevAdded":null},{"id":"CVE-2026-31898","published":"2026-03-18T03:03:43.469Z","updated":"2026-09-07T12:05:09.452Z","title":"jsPDF has a PDF Object Injection via FreeText color","severity":"HIGH","score":8.1,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00378,"kevAdded":null},{"id":"CVE-2026-25940","published":"2026-02-19T15:26:57.645Z","updated":"2026-09-07T12:05:04.658Z","title":"jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and \"AS\" property)","severity":"HIGH","score":8.1,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-25755","published":"2026-02-19T14:41:46.941Z","updated":"2026-09-07T12:05:03.219Z","title":"jsPDF has PDF Object Injection via Unsanitized Input in addJS Method","severity":"HIGH","score":8.1,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00952,"kevAdded":null},{"id":"CVE-2026-25535","published":"2026-02-19T14:34:05.648Z","updated":"2026-09-07T12:04:56.383Z","title":"jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions","severity":"HIGH","score":8.7,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.0084,"kevAdded":null},{"id":"CVE-2026-24040","published":"2026-02-02T20:38:24.732Z","updated":"2026-02-03T15:30:05.465Z","title":"jsPDF has a Shared State Race Condition in addJS Plugin","severity":"MEDIUM","score":6.3,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-24043","published":"2026-02-02T20:34:50.617Z","updated":"2026-02-03T15:27:51.282Z","title":"jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)","severity":"MEDIUM","score":6.9,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-24133","published":"2026-02-02T20:32:37.631Z","updated":"2026-02-03T15:17:40.830Z","title":"jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder","severity":"HIGH","score":8.7,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2026-24737","published":"2026-02-02T20:29:05.011Z","updated":"2026-08-18T12:05:36.324Z","title":"jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution","severity":"HIGH","score":8.1,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00589,"kevAdded":null},{"id":"CVE-2025-68428","published":"2026-01-05T21:43:55.169Z","updated":"2026-09-07T12:04:51.936Z","title":"jsPDF has Local File Inclusion/Path Traversal vulnerability","severity":"CRITICAL","score":9.2,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.02177,"kevAdded":null},{"id":"CVE-2025-57810","published":"2025-08-26T15:37:28.071Z","updated":"2025-08-26T15:58:25.184Z","title":"jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)","severity":"HIGH","score":8.7,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00688,"kevAdded":null},{"id":"CVE-2025-29907","published":"2025-03-18T18:40:57.504Z","updated":"2025-03-18T19:02:49.720Z","title":"jsPDF Bypass Regular Expression Denial of Service (ReDoS)","severity":"HIGH","score":8.7,"vendor":"parallax","product":"jsPDF","kev":false,"epss":0.00699,"kevAdded":null}]}