verapdf has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was July 2026 with 5. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-611 (3). Most affected products: org.verapdf:validation-model (3), org.verapdf:parser (2).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: 6.5
Publish → KEV: —
Last 90 days: 5 prev 0

Weakness classes

Products

org.verapdf:validation-model 3
org.verapdf:parser 2

Follow verapdf:RSS feed Save a search →Embed badge ↗

5

Total CVEs

0

Critical

0

CISA KEV

0

Exploited

Worst active — by depth score

verapdf vulnerabilities

CVEs affecting verapdf, newest first. Open any entry for full detail, references, and exploit status.

5 CVEsRSS

CVE-2026-54079High

veraPDF Validation XXE via XFA

veraPDF Validation XXE via XFA

▾ Twilightverapdf · org.verapdf:validation-modelEPSS 0.32%via GHSA

CVE-2026-54078High

veraPDF Validation XXE via Rich Text

veraPDF Validation XXE via Rich Text

▾ Twilightverapdf · org.verapdf:validation-modelEPSS 0.32%via GHSA

CVE-2026-54082Medium· 6.5

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

▾ Sunlitverapdf · org.verapdf:validation-modelEPSS 0.23%via GHSA

CVE-2026-54080Medium

veraPDF Parser DoS via PostScript CMap Streams

veraPDF Parser DoS via PostScript CMap Streams

▾ Sunlitverapdf · org.verapdf:parserEPSS 0.30%via GHSA

CVE-2026-54081Medium

veraPDF Parser DoS via PostScript Type 1 Font Programs

veraPDF Parser DoS via PostScript Type 1 Font Programs

▾ Sunlitverapdf · org.verapdf:parserEPSS 0.30%via GHSA

verapdf vulnerabilities (CVEs) · VulnSea