TThe Document Foundation

Products

Exploited and recent CVEs

• CVE-2026-76181 Medium 6.6 Heap buffer overflow in dBASE index import 0.1%
• CVE-2026-63270 Medium 6.7 Environment/ini-file leaks 0.1%
• CVE-2026-63269 Medium 6.7 LFI and GET SSRF via GStreamer and HLS playlists 0.1%
• CVE-2026-63268 Medium 6.7 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href 0.1%
• CVE-2026-63267 Medium 6.7 LFI and GET SSRF via calcext:data-mappings and csv provider 0.1%
• CVE-2026-63266 Medium 6.8 Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality 0.2%
• CVE-2026-63277 High 8.5 RCE via calcext:data-mappings, sql provider and jdbc connector 0.3%
• CVE-2026-63279 Medium 5.4 Out of bounds read in PICT image import 0.2%
• CVE-2026-63278 Medium 6.7 Package URLs can be used to exfiltrate arbitrary INI file values and environment variables 0.1%
• CVE-2026-63276 Medium 5.4 Stack buffer overflow in CFF to Type 1 font conversion 0.2%
• CVE-2026-63275 Medium 5.4 Stack buffer overflow in CFF font hint handling 0.2%
• CVE-2026-63274 Medium 5.4 Heap buffer overflow in PDF import stream handling 0.2%
• CVE-2026-63273 Medium 5.4 Heap buffer overflow in PDF import encryption handling 0.1%
• CVE-2026-63272 Medium 5.4 Heap buffer overflow in WMF text record import 0.2%
• CVE-2026-8358 Medium 5.4 Heap buffer overflow in spreadsheet tracked-changes import 0.2%
• CVE-2026-8357 High 7.8 Heap buffer overflow in Calc formula compilation 0.2%
• CVE-2026-8356 Medium 5.4 Stack buffer overflow in PPT presentation import 0.2%
• CVE-2026-6047 Medium 5.4 Heap buffer overflow in OOXML text box element import 0.2%
• CVE-2026-6045 Medium 5.4 Heap buffer overflow in EMF+ gradient brush import 0.2%
• CVE-2026-6040 High 7.3 Heap use-after-free in ODF number-format blank-width parsing 0.2%
• CVE-2026-6039 Medium 5.4 Heap buffer overflow in DXF polyline import 0.2%
• CVE-2026-4430 Medium 5.4 Heap Buffer Overflow in AgileEngine <0.1%
• CVE-2025-14714 Low 0.9 TCC Bypass via Inherited Permissions in Bundled Interpreter 0.1%
• CVE-2025-2866 Low 2.4 PDF signature forgery with adbe.pkcs7.sha1 SubFilter 0.1%
• CVE-2021-25635 Medium 5.2 Content Manipulation with Certificate Validation Attack 0.1%
• CVE-2025-1080 High 7.2 Macro URL arbitrary script execution 0.3%
• CVE-2025-0514 High 7.2 Executable hyperlink Windows path targets executed unconditionally on activation 0.3%
• CVE-2024-12426 Medium 6.7 URL fetching can be used to exfiltrate arbitrary INI file values and environment variables 0.5%
• CVE-2024-12425 Low 2.4 Path traversal leading to arbitrary .ttf file write 0.3%
• CVE-2024-7788 High 7.8 Signatures in "repair mode" should not be trusted 0.2%