Parall
7 CVEs tracked since 2026. Since Feb 2026, none of them reached CISA KEV.
Parall CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2026-02 | 7 | 0 |
Products
The products that kept showing up in Parall's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Parall.
- CVE-2026-31938jsPDF has HTML Injection in New Window paths9.6
- CVE-2026-31898jsPDF has a PDF Object Injection via FreeText color8.1
- CVE-2026-25940jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)8.1
- CVE-2026-25755jsPDF has PDF Object Injection via Unsanitized Input in addJS Method8.1
- CVE-2026-25535jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions7.5
- CVE-2026-24040jsPDF has a Shared State Race Condition in addJS Plugin4.8
- CVE-2026-24043jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)5.4
- CVE-2026-24133jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder6.5
- CVE-2026-24737jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution8.1
- CVE-2025-68428jsPDF has Local File Inclusion/Path Traversal vulnerability7.5
- CVE-2025-57810jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)7.5
- CVE-2025-29907jsPDF Bypass Regular Expression Denial of Service (ReDoS)7.5
- CVE-2021-23353Regular Expression Denial of Service (ReDoS)5.9
- CVE-2020-7690All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.6.1
- CVE-2020-7691Cross-site Scripting (XSS)6.3
The record
- Peak rank
- #157 in Feb 2026
- Busiest month shown
- Feb 2026, 7 CVEs
- Months with a KEV entry
- 0 since Feb 2026
- Monthly snapshots
- 1 since 2026