CVE-2026-63266

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.

• CWE-22

• https://www.libreoffice.org/about-us/security/advisories/cve-2026-63266

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63260Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-63261Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-63262Missing Authorization (CWE-862) in Kibana can lead to unauth…4.3
• CVE-2026-63263Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-63264Joomla Extension - joomshopping.com - Reflective XSS in Joom…5.3
• CVE-2026-63265Joomla Extension - regularlabs.com - Inconsistent CSRF token…8
• CVE-2026-63267LibreOffice Calc can link a cell range to an external csv da…6.7
• CVE-2026-63268LibreOffice Calc can link a cell range to an external data s…6.7
• CVE-2026-63269LibreOffice can link to audio and video files from a documen…6.7
• CVE-2026-6327IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized …4.3
• CVE-2026-63270URLs could be constructed which expanded environment variabl…6.7
• CVE-2026-63272LibreOffice can import WMF graphics, which may be embedded i…5.4