4
CVEs
0
Critical
0
High
0
KEV
0
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (6)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-1591 | Foxit PDF Editor Cloud contains a stored XSS vulnerability in its file upload functionality where malicious usernames are not properly sanitized before being displayed in the upload file list, enabling authenticated attackers to execute arbitrary JavaScript in other users' browsers. The vulnerability affects pdfonline.foxit.com versions prior to 2026-02-03 and currently has no available patch. An attacker with valid credentials could craft a malicious username to compromise account security or steal sensitive document data from other users viewing the file list. | MEDIUM | 6.3 | 0.0% | 32 |
No patch
|
| CVE-2026-1592 | Stored cross-site scripting in Foxit PDF Editor Cloud's Create New Layer feature allows authenticated attackers to execute arbitrary JavaScript by injecting malicious code that persists when layers are accessed by other users. The vulnerability affects pdfonline.foxit.com versions prior to 2026-02-03 and requires user interaction to trigger. No patch is currently available. | MEDIUM | 6.3 | 0.0% | 32 |
No patch
|
| CVE-2025-66523 | URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary scripts when an authenticated user visits a crafted link. [CVSS 6.1 MEDIUM] | MEDIUM | 6.1 | 0.0% | 31 |
No patch
|
| CVE-2026-18622 | Foxit PDF Editor and Foxit PDF Reader fail to consistently alert users when digital signature fields are manipulated - including alterations to field appearance streams, coordinate repositioning, or field duplication within a document. An attacker who delivers a specially crafted PDF to a target can exploit the flawed UI feedback to make a tampered document appear validly signed, directly undermining the integrity assurance that digital signatures exist to provide. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. | MEDIUM | 5.5 | 0.1% | 28 |
No patch
|