Vulnerabilities

TI-2026-74400 CVE-2026-102354

Server-side request forgery in BentoPDF CORS proxy via DNS rebinding

LOW 29

BentoPDF is a privacy-focused PDF toolkit that runs in the browser.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.002 Published 2026-10-14 Fixed in 2.8.7 CWE-367

TI-2026-45275 CVE-2026-63630

MEDIUM 50

BentoPDF is a client-side PDF toolkit that is self hostable.

CVSS 3.1LOW 3.4 Network No auth User interaction EPSS 0.00382 Published 2026-09-24 Fixed in 2.8.7 CWE-201

TI-2026-54083 CVE-2026-77581

HIGH 76

BentoPDF is a client-side PDF toolkit that is self hostable.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00266 Published 2026-09-24 Fixed in 2.8.7 CWE-918

TI-2026-30171 CVE-2026-41653

LOW 31

BentoPDF is a client-side PDF toolkit that is self hostable.

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00356 Published 2026-05-07 Fixed in 2.8.3 CWE-79