CVE-2026-41653Disclosure

LOWCVSS 7.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This issue has been patched in version 2.8.3.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-05-07); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-07	2	Disclosure2
2026-05-08	1	Disclosure1

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds154d
Disclosure
CVE-2026-41653 Cross-Site Scripting Vulnerability in BentoPDF Markdown to PDF To... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41653 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces a new Cross‑Site Scripting vulnerability (CVE-2026‑41653) in BentoPDF Markdown to PDF and provides a link to details, but does not supply a PoC, exploit code, active exploitation evidence, or a patch.
0000081
4.0K followersView on X
Infoflowcloud@infoflowcloud154d
Disclosure
🚨*CVE* CVE-2026-41653 BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may b… https://www.cve.org/CVERecord?id=CVE-2026-41653 ----- Traducción: CVE-2026-41653 Ben… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑41653 as a client‑side XSS flaw in BentoPDF, specifying the affected version range but providing no PoC, exploit, or patch information.
0000064
75 followersView on X
CVE@CVEnew154d
Disclosure
CVE-2026-41653 BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may b… https://www.cve.org/CVERecord?id=CVE-2026-41653
Post summary
The post announces a cross‑site scripting flaw in BentoPDF versions earlier than 2.8.3, without mentioning any PoC, exploit code, active exploitation, or patch details.
00000149
57.4K followersView on X

Explore more

Back to dashboard