Vendor

veraPDF

7 known vulnerabilities.

Products

veraPDF-validation 3 veraPDF-parser 2 veraPDF-library 2

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

High 8.7

CVE-2026-54078

veraPDF Validation XXE via Rich Text

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/Dictionar…

veraPDF veraPDF-validation org.verapdf:validation-model-jakarta org.verapdf:validation-model Maven

Jul 29, 2026
High 8.7

CVE-2026-54079

veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulnerability in validation-model/src/main/java/org/verapdf/gf/mod…

veraPDF veraPDF-validation org.verapdf:validation-model-jakarta org.verapdf:validation-model Maven

Jul 29, 2026
High 8.1

CVE-2024-28109

Potential XSLT injection vulnerability when using policy files

veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.

veraPDF veraPDF-library org.verapdf:core-jakarta org.verapdf:verapdf-library Maven

Mar 28, 2024