Skip to content
OpenAdvisories

Vendor

alam00000

4 known vulnerabilities.

Products

bentopdf 4
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.4
    CVE-2026-63630

    BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests

    BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs…

    alam00000 bentopdf