October 7, 2026
- LibreOffice and Apache OpenOffice will execute attacker code on opening a crafted Calc file, with no macro prompt, when Java support is enabled. A database range pulls a remote ODB file, which names a JDBC driver and a remote JAR; the program downloads and instantiates it in-process. LibreOffice fixed it as CVE-2026-63277 on October 5 (26.2.5 / 26.8.0, alongside an arbitrary file write and several file-read/SSRF bugs); Apache OpenOffice's CVE-2026-59265 is unfixed through 4.1.16, with 4.1.17 still in testing — disable Java as a workaround. The V12 team published a PoC; no in-the-wild use reported (The Hacker News). · Vulnerabilities & Exploits
in Pre-Auth File Read Hits Eight Atlassian Data Center Products