CVE-2026-91788
Medium · 4.7CVSS
4.7
EPSS
0.1%
Published
Sep 23, 2026
CISA due date
—
The record
When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115522 Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent… CWE-668
- CVE-2026-57144 PraisonAI is a multi-agent teams system. CWE-668
- CVE-2026-112936 filelock is a platform-independent file lock for Python. CWE-668
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-668
- CVE-2026-92940 vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to… CWE-668
- CVE-2026-85053 Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82… CWE-668
- CVE-2026-82652 SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks… CWE-668
- CVE-2026-82650 SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the… CWE-668