parall records
15 published records for vendor parall.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-116 Improper Encoding or Escaping of Output3
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3
- CWE-400 Uncontrolled Resource Consumption2
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')1
- CWE-35 Path Traversal: '.../...//'1
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
15 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
37Monitor | CVE-2025-68428Proof of concept | jsPDF has Local File Inclusion/Path Traversal vulnerabilityparall · jspdf · CWE-35 | Critical9.2 | — | 2.1% | Jan 5, 2026 |
35Monitor | CVE-2026-25755Proof of concept | jsPDF has PDF Object Injection via Unsanitized Input in addJS Methodparall · jspdf · CWE-94 | High8.8 | — | 0.9% | Feb 19, 2026 |
34Monitor | CVE-2026-25535No exploit | jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensionsparall · jspdf · CWE-400 | High8.7 | — | 1.0% | Feb 19, 2026 |
34Monitor | CVE-2025-57810No exploit | jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)parall · jspdf · CWE-20 | High8.7 | — | 0.7% | Aug 26, 2025 |
34Monitor | CVE-2025-29907No exploit | jsPDF Bypass Regular Expression Denial of Service (ReDoS)parall · jspdf · CWE-400 | High8.7 | — | 0.6% | Mar 18, 2025 |
34Monitor | CVE-2026-24133No exploit | jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoderparall · jspdf · CWE-770 | High8.7 | — | 0.6% | Feb 2, 2026 |
32Monitor | CVE-2026-25940Proof of concept | jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)parall · jspdf · CWE-116 | High8.1 | — | 0.7% | Feb 19, 2026 |
32Monitor | CVE-2026-24737No exploit | jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Executionparall · jspdf · CWE-116 | High8.1 | — | 0.5% | Feb 2, 2026 |
31Monitor | CVE-2021-23353No exploit | Regular Expression Denial of Service (ReDoS)parall · jspdf | High7.5 | — | 2.6% | Mar 9, 2021 |
27Monitor | CVE-2026-24043No exploit | jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)parall · jspdf · CWE-74 | Medium6.9 | — | 0.2% | Feb 2, 2026 |
26Monitor | CVE-2026-31898No exploit | jsPDF has a PDF Object Injection via FreeText colorparall · jspdf · CWE-116 | Medium6.5 | — | 0.6% | Mar 18, 2026 |
25Monitor | CVE-2026-24040No exploit | jsPDF has a Shared State Race Condition in addJS Pluginparall · jspdf · CWE-362 | Medium6.3 | — | 0.2% | Feb 2, 2026 |
24Monitor | CVE-2020-7691No exploit | Cross-site Scripting (XSS)parall · jspdf · CWE-79 | Medium6.1 | — | 1.5% | Jul 6, 2020 |
24Monitor | CVE-2020-7690No exploit | All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS).parall · jspdf · CWE-79 | Medium6.1 | — | 0.9% | Jul 6, 2020 |
24Monitor | CVE-2026-31938No exploit | jsPDF has HTML Injection in New Window pathsparall · jspdf · CWE-79 | Medium6.1 | — | 0.4% | Mar 18, 2026 |
- CVE-2025-6842837Monitor
jsPDF has Local File Inclusion/Path Traversal vulnerability
CriticalCVSS 9.2Proof of conceptEPSS 2%parall · jspdfJan 5, 2026
- CVE-2026-2575535Monitor
jsPDF has PDF Object Injection via Unsanitized Input in addJS Method
HighCVSS 8.8Proof of conceptEPSS 0%parall · jspdfFeb 19, 2026
- CVE-2026-2553534Monitor
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
HighCVSS 8.7No exploitEPSS 1%parall · jspdfFeb 19, 2026
- CVE-2025-5781034Monitor
jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)
HighCVSS 8.7No exploitEPSS 0%parall · jspdfAug 26, 2025
- CVE-2025-2990734Monitor
jsPDF Bypass Regular Expression Denial of Service (ReDoS)
HighCVSS 8.7No exploitEPSS 0%parall · jspdfMar 18, 2025
- CVE-2026-2413334Monitor
jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
HighCVSS 8.7No exploitEPSS 0%parall · jspdfFeb 2, 2026
- CVE-2026-2594032Monitor
jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
HighCVSS 8.1Proof of conceptEPSS 0%parall · jspdfFeb 19, 2026
- CVE-2026-2473732Monitor
jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution
HighCVSS 8.1No exploitEPSS 0%parall · jspdfFeb 2, 2026
- CVE-2021-2335331Monitor
Regular Expression Denial of Service (ReDoS)
HighCVSS 7.5No exploitEPSS 2%parall · jspdfMar 9, 2021
- CVE-2026-2404327Monitor
jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)
MediumCVSS 6.9No exploitEPSS 0%parall · jspdfFeb 2, 2026
- CVE-2026-3189826Monitor
jsPDF has a PDF Object Injection via FreeText color
MediumCVSS 6.5No exploitEPSS 0%parall · jspdfMar 18, 2026
- CVE-2026-2404025Monitor
jsPDF has a Shared State Race Condition in addJS Plugin
MediumCVSS 6.3No exploitEPSS 0%parall · jspdfFeb 2, 2026
- CVE-2020-769124Monitor
Cross-site Scripting (XSS)
MediumCVSS 6.1No exploitEPSS 1%parall · jspdfJul 6, 2020
- CVE-2020-769024Monitor
All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS).
MediumCVSS 6.1No exploitEPSS 0%parall · jspdfJul 6, 2020
- CVE-2026-3193824Monitor
jsPDF has HTML Injection in New Window paths
MediumCVSS 6.1No exploitEPSS 0%parall · jspdfMar 18, 2026