Security Reports
Technical writeups of coordinated vulnerability disclosures — discovered, exploited, and reported to maintainers before public release. All issues were fixed by the vendors.
RCE
CVE-2026-105080
C4illin/ConvertX
Remote code execution via calibre
.recipe upload — Python exec as root.CVSS 9.4 CRITICAL
Read more →
DoS
GHSA-w2hj-54mc-76r4 · CVE pending
pdfcpu/pdfcpu
Integer overflow in XRef stream
/W array sum causes unrecovered panic.CVSS 7.5 HIGH
Read more →
DoS
GHSA-fjh6-rrhv-4g63 · CVE pending
pdfcpu/pdfcpu
Traditional XRef tables bypass configured limits — unbounded memory growth.
CVSS 6.5 MEDIUM
Read more →
Overflow
GHSA-g766-88fx-58h8 · CVE pending
pdfcpu/pdfcpu
Integer overflow in image buffer allocation (
w*h*N) — defense-in-depth.CVSS 5.9 MEDIUM
Read more →
DoS
GHSA-6524-w46v-6399 · CVE pending
pdfcpu/pdfcpu
Index-out-of-range panics in PDF image renderers (
bpc 9..16, short Indexed lookup).CVSS 6.5 MEDIUM
Read more →