# cve.now: THE Document Foundation

The newest entries naming THE Document Foundation as an affected vendor (up to 200), of 49 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-76181](https://cve.now/CVE-2026-76181.md): Heap buffer overflow in dBASE index import (CVSS 5.4)
- [CVE-2026-63270](https://cve.now/CVE-2026-63270.md): Environment/ini-file leaks (CVSS 6.7)
- [CVE-2026-63269](https://cve.now/CVE-2026-63269.md): LFI and GET SSRF via GStreamer and HLS playlists (CVSS 6.7)
- [CVE-2026-63268](https://cve.now/CVE-2026-63268.md): LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href (CVSS 6.7)
- [CVE-2026-63267](https://cve.now/CVE-2026-63267.md): LFI and GET SSRF via calcext:data-mappings and csv provider (CVSS 6.7)
- [CVE-2026-63266](https://cve.now/CVE-2026-63266.md): Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality (CVSS 6.8)
- [CVE-2026-63277](https://cve.now/CVE-2026-63277.md): RCE via calcext:data-mappings, sql provider and jdbc connector (CVSS 8.5)
- [CVE-2026-63279](https://cve.now/CVE-2026-63279.md): Out of bounds read in PICT image import (CVSS 5.4)
- [CVE-2026-63278](https://cve.now/CVE-2026-63278.md): Package URLs can be used to exfiltrate arbitrary INI file values and environment variables (CVSS 6.7)
- [CVE-2026-63276](https://cve.now/CVE-2026-63276.md): Stack buffer overflow in CFF to Type 1 font conversion (CVSS 5.4)
- [CVE-2026-63275](https://cve.now/CVE-2026-63275.md): Stack buffer overflow in CFF font hint handling (CVSS 5.4)
- [CVE-2026-63274](https://cve.now/CVE-2026-63274.md): Heap buffer overflow in PDF import stream handling (CVSS 5.4)
- [CVE-2026-63273](https://cve.now/CVE-2026-63273.md): Heap buffer overflow in PDF import encryption handling (CVSS 5.4)
- [CVE-2026-63272](https://cve.now/CVE-2026-63272.md): Heap buffer overflow in WMF text record import (CVSS 5.4)
- [CVE-2026-8358](https://cve.now/CVE-2026-8358.md): Heap buffer overflow in spreadsheet tracked-changes import (CVSS 5.4)
- [CVE-2026-8357](https://cve.now/CVE-2026-8357.md): Heap buffer overflow in Calc formula compilation (CVSS 5.4)
- [CVE-2026-8356](https://cve.now/CVE-2026-8356.md): Stack buffer overflow in PPT presentation import (CVSS 5.4)
- [CVE-2026-6047](https://cve.now/CVE-2026-6047.md): Heap buffer overflow in OOXML text box element import (CVSS 5.4)
- [CVE-2026-6045](https://cve.now/CVE-2026-6045.md): Heap buffer overflow in EMF+ gradient brush import (CVSS 5.4)
- [CVE-2026-6040](https://cve.now/CVE-2026-6040.md): Heap use-after-free in ODF number-format blank-width parsing (CVSS 5.4)
- [CVE-2026-6039](https://cve.now/CVE-2026-6039.md): Heap buffer overflow in DXF polyline import (CVSS 5.4)
- [CVE-2026-4430](https://cve.now/CVE-2026-4430.md): Heap Buffer Overflow in AgileEngine (CVSS 5.4)
- [CVE-2025-14714](https://cve.now/CVE-2025-14714.md): TCC Bypass via Inherited Permissions in Bundled Interpreter (CVSS 0.9)
- [CVE-2025-2866](https://cve.now/CVE-2025-2866.md): PDF signature forgery with adbe.pkcs7.sha1 SubFilter (CVSS 2.4)
- [CVE-2021-25635](https://cve.now/CVE-2021-25635.md): Content Manipulation with Certificate Validation Attack (CVSS 5.2)
- [CVE-2025-1080](https://cve.now/CVE-2025-1080.md): Macro URL arbitrary script execution (CVSS 7.2)
- [CVE-2025-0514](https://cve.now/CVE-2025-0514.md): Executable hyperlink Windows path targets executed unconditionally on activation (CVSS 7.2)
- [CVE-2024-12426](https://cve.now/CVE-2024-12426.md): URL fetching can be used to exfiltrate arbitrary INI file values and environment variables (CVSS 6.7)
- [CVE-2024-12425](https://cve.now/CVE-2024-12425.md): Path traversal leading to arbitrary .ttf file write (CVSS 2.4)
- [CVE-2024-7788](https://cve.now/CVE-2024-7788.md): Signatures in "repair mode" should not be trusted (CVSS 7.8)
- [CVE-2024-6472](https://cve.now/CVE-2024-6472.md): Ability to trust not validated macro signatures removed in high security mode (CVSS 7.8)
- [CVE-2024-5261](https://cve.now/CVE-2024-5261.md): TLS certificate are not properly verified when utilizing LibreOfficeKit (CVSS 10.0)
- [CVE-2024-3044](https://cve.now/CVE-2024-3044.md): Graphic on-click binding allows unchecked script execution (CVSS 6.5)
- [CVE-2023-6186](https://cve.now/CVE-2023-6186.md): Link targets allow arbitrary script execution (CVSS 8.3)
- [CVE-2023-6185](https://cve.now/CVE-2023-6185.md): Improper input validation enabling arbitrary Gstreamer pipeline injection (CVSS 8.3)
- [CVE-2023-2255](https://cve.now/CVE-2023-2255.md): Remote documents loaded without prompt via IFrame (no CVSS)
- [CVE-2023-0950](https://cve.now/CVE-2023-0950.md): Array Index UnderFlow in Calc Formula Parsing (CVSS 7.8)
- [CVE-2022-3140](https://cve.now/CVE-2022-3140.md): Macro URL arbitrary script execution (no CVSS)
- [CVE-2022-26307](https://cve.now/CVE-2022-26307.md): Weak Master Keys (no CVSS)
- [CVE-2022-26306](https://cve.now/CVE-2022-26306.md): Execution of Untrusted Macros Due to Improper Certificate Validation (no CVSS)
- [CVE-2022-26305](https://cve.now/CVE-2022-26305.md): Execution of Untrusted Macros Due to Improper Certificate Validation (no CVSS)
- [CVE-2021-25636](https://cve.now/CVE-2021-25636.md): Incorrect trust validation of signature with ambiguous KeyInfo children (no CVSS)
- [CVE-2021-25634](https://cve.now/CVE-2021-25634.md): Timestamp Manipulation with Signature Wrapping (no CVSS)
- [CVE-2021-25633](https://cve.now/CVE-2021-25633.md): Content Manipulation with Double Certificate Attack (no CVSS)
- [CVE-2021-25631](https://cve.now/CVE-2021-25631.md): denylist of executable filename extensions possible to bypass under windows (no CVSS)
- [CVE-2021-25630](https://cve.now/CVE-2021-25630.md): "loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. (no CVSS)
- [CVE-2020-12803](https://cve.now/CVE-2020-12803.md): XForms submissions could overwrite local files (no CVSS)
- [CVE-2020-12802](https://cve.now/CVE-2020-12802.md): remote graphics contained in docx format retrieved in 'stealth mode' (no CVSS)
- [CVE-2020-12801](https://cve.now/CVE-2020-12801.md): Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next save (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/the-document-foundation
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.