Login Request a demo
DO
Product
dompdf
by dompdf · last CVE Jul 28, 2026
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 2High 5Medium 2Low 0
Severity
All severities10Critical2High5Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add dompdf to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-3902
9.8
1%
Nov 15
Improper Restriction of XML External Entity Reference in dompdf/dompdf
Affected: before 2.0.0
CVE-2021-3838
9.8
1%
Nov 15
PHAR Deserialization in dompdf/dompdf
Affected: before 2.0.0
CVE-2026-59941
7.5
1%
Jul 28
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Affected: < 3.1.6
CVE-2026-59942
7.5
1%
Jul 28
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
Affected: < 3.1.6
CVE-2026-55554
7.5
0%
Jul 28
Dompdf: Chroot Validation Bypass
Affected: < 3.1.6
CVE-2026-55555
7.5
1%
Jul 28
Dompdf: File existence oracle via font-face stylesheet declaration
Affected: < 3.1.6
CVE-2023-50262
7.5
1%
Dec 13
Dompdf possible DoS caused by infinite recursion when parsing SVG images
Affected: < 2.0.4
CVE-2026-59943
5.3
0%
Jul 28
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
Affected: < 3.1.6
CVE-2026-56722
5.3
0%
Jul 28
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Affected: < 3.1.6
CVE-2014-2383
–
39%
Apr 28
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol…
Affected: through 0.6.0
Showing 10