Kozea vulnerabilities
We track 6 vulnerabilities in Kozea products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest Kozea vulnerabilities
- 8.7 High severity
CairoSVG: Inefficient Algorithmic Complexity
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and resc
- 8.8 High severity
WeasyPrint helps web developers to create PDF documents.
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher wit
- 7.5 High severity
CairoSVG: Uncontrolled Recursion
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.
- 7.5 High severity
WeasyPrint: Server-Side Request Forgery
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such a
- 7.4 High severity
WeasyPrint: Inclusion of Functionality from Untrusted Control Sphere
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs
- 7.1 High severity
CairoSVG: Server-Side Request Forgery
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side