CVE-2026-54079

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

CVE-2026-54082

The CVE-2026-54082 entry affects veraPDF-validation, specifically the PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender() paths. The issue stems from parsing using the default DocumentBuilderFactory, enabling XML External Entity (XXE) processing when handling rich-text annotations, fo...