Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2531▼ 362 respecto a la semana anterior

Críticas / altas1340▲ 76 respecto a la semana anterior

Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior

4 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2026-22787	Analizada	Alta (8.7)	0.38%	—	Ekoopmans Html2pdf.js	14/1/2026	17/6/2026	html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts…
CVE-2024-34342	Aplazada	Alta (7.1)	1.1%	—	React-pdf^AI Mozilla Pdf.js^AI	7/5/2024	17/6/2026	react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
CVE-2022-4670	Modificada	Media (5.4)	0.56%	—	Pdf.js Viewer Project Pdf.js Viewer	6/2/2023	17/6/2026	The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2021-24759	Modificada	Media (5.4)	0.62%	—	Pdf.js Viewer Project Pdf.js Viewer	6/12/2021	17/6/2026	The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks