alam00000 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM alam00000 CVE published 2026-10-14

CVE-2026-102354

A vulnerability in BentoPDF, a privacy-focused PDF toolkit that runs in the browser, allows for Server-Side Request Forgery (SSRF) via DNS Rebinding (TOCTOU) in the Cloudflare CORS Proxy Worker. This issue affects versions through 2.8.6 and is fixed in version 2.8.7. The vulnerability involves a DNS-over-HTTPS safety check that can be bypassed by a direct client controlling authoritative DNS, allowing for [truncated]