parallax
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 1
en
Verify to analyze this security profile
As of 09/18/2026, parallax recorded 1 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, filament-comments had the most security vulnerabilities in the parallax ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-90943parallax filament-comments through 3.0.0 Stored XSS via Comment Body | Exploitation statusNot known exploited | FixYes | Affected productfilament-comments | Published09/14/2026 | SeverityCritical |
CVE-2026-31938jsPDF has HTML Injection in New Window paths | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published03/18/2026 | SeverityCritical |
CVE-2026-31898jsPDF has a PDF Object Injection via FreeText color | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published03/18/2026 | SeverityHigh |
CVE-2026-25940jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published02/19/2026 | SeverityCritical |
CVE-2026-25755jsPDF has PDF Object Injection via Unsanitized Input in addJS Method | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published02/19/2026 | SeverityCritical |
CVE-2026-25535jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions | Exploitation statusPublic exploit | FixYes | Affected productjsPDF | Published02/19/2026 | SeverityHigh |
CVE-2026-24040jsPDF has a Shared State Race Condition in addJS Plugin | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published02/02/2026 | SeverityMedium |
CVE-2026-24043jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation) | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published02/02/2026 | SeverityMedium |
CVE-2026-24133jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published02/02/2026 | SeverityHigh |
CVE-2026-24737jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published02/02/2026 | SeverityHigh |
CVE-2025-68428jsPDF has Local File Inclusion/Path Traversal vulnerability | Exploitation statusNot known exploited | FixYes | Affected productjsPDF | Published01/05/2026 | SeverityCritical |
CVE-2025-57810jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS) | Exploitation statusPublic exploit | FixYes | Affected productjsPDF | Published08/26/2025 | SeverityHigh |
CVE-2025-29907jsPDF Bypass Regular Expression Denial of Service (ReDoS) | Exploitation statusPublic exploit | FixYes | Affected productjsPDF | Published03/18/2025 | SeverityHigh |