LI
Product
Libreoffice
71
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 26Medium 15Low 1
Watch
Add Libreoffice to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-6186 | 8.8 | Dec 11 | Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning Affected: 7.5.0 before 7.5.9; 7.6.0 before 7.6.4 |
| CVE-2023-6185 | 8.8 | Dec 11 | Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins Affected: 7.5.0 before 7.5.9; 7.6.0 before 7.6.3 |
| CVE-2022-26307 | 8.8 | Jul 25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database Affected: 7.2.0 before 7.2.7; 7.3.0 before 7.3.3 |
| CVE-2021-25631 | 8.8 | May 3 | In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't… Affected: 7.0.0 before 7.0.5; 7.1.0 before 7.1.2 |
| CVE-2026-4430 | 7.8 | May 7 | Heap Buffer Overflow in AgileEngine Affected: 25.8.0.0 before 25.8.7.0; 26.2.0.0 before 26.2.3.0 |
| CVE-2025-1080 | 7.8 | Mar 4 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server Affected: 24.8.0.0 before 24.8.5.1; 25.2.0.0 before 25.2.1.1 |
| CVE-2025-0514 | 7.8 | Feb 25 | Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue… Affected: 24.8.0.0 before 24.8.5.1 |
| CVE-2024-7788 | 7.8 | Sep 17 | Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue… Affected: 24.2.0 before 24.2.5 |
| CVE-2024-6472 | 7.8 | Aug 5 | Certificate Validation user interface in LibreOffice allows potential vulnerability Affected: 24.2.0.0 before 24.2.5.1 |
| CVE-2023-0950 | 7.8 | May 25 | Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will… Affected: 7.4.0 before 7.4.6; 7.5.0 before 7.5.2 |
| CVE-2019-9853 | 7.8 | Sep 27 | LibreOffice documents can contain macros Affected: 6.2.0 before 6.2.6; 6.3.0 before 6.3.1 |
| CVE-2019-9854 | 7.8 | Sep 6 | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc Affected: 6.2.0 before 6.2.7; 6.3.0 before 6.3.1 |
| CVE-2019-9852 | 7.8 | Aug 15 | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc Affected: before 6.2.6 |
| CVE-2019-9847 | 7.8 | May 9 | A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users… Affected: before 6.1.6; 6.2 before 6.2.3 |
| CVE-2018-10120 | 7.8 | Apr 16 | The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows… Affected: before 5.4.6.1; 6.0.0 before 6.0.2.1 |
| CVE-2018-10119 | 7.8 | Apr 16 | sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to… Affected: before 5.4.5.1; 6.0.0 before 6.0.1.1 |
| CVE-2016-4324 | 7.8 | Jul 8 | Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens Affected: through 5.1.3 |
| CVE-2016-0795 | 7.8 | Feb 18 | LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record… Affected: through 5.0.4 |
| CVE-2016-0794 | 7.8 | Feb 18 | The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted… Affected: through 5.0.3 |
| CVE-2022-26306 | 7.5 | Jul 25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database Affected: 7.2.0 before 7.2.7; 7.3.0 before 7.3.3 |
| CVE-2022-26305 | 7.5 | Jul 25 | An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and… Affected: 7.2.0 before 7.2.7; 7.3.0 before 7.3.2 |
| CVE-2021-25636 | 7.5 | Feb 24 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and… Affected: 7.2.0 before 7.2.5 |
| CVE-2021-25634 | 7.5 | Oct 12 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and… Affected: 7.0.0 before 7.0.6; 7.1.0 before 7.1.2 |
| CVE-2021-25633 | 7.5 | Oct 11 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and… Affected: 7.0.0 before 7.0.6; 7.1.0 before 7.1.2 |
| CVE-2018-10583 | 7.5 | May 1 | An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a… Affected: 6.0.3 |
| CVE-2017-14226 | 7.5 | Sep 9 | WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service… Affected: through 5.3.6 |
Showing 26