https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:08:19.722577+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-371347 EUVD-2026-371347 2026-10-06T16:08:19.769403+00:00 EUVD-2026-371347 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82472 fkie_cve-2026-82472 2026-10-06T16:08:19.769441+00:00

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

 https://cve.radiocsirt.org/vuln/ghsa-qm54-2jq3-88j9 GHSA-qm54-2jq3-88j9 2026-10-06T16:08:19.769474+00:00

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.