_{Report generated on: September 27, 2026 at 03:20 UTC}

Introduction

Our Commitment to Security

Welcome to the UniDoc Security Hub. At UniDoc, the security of our products is a top priority. We are committed to being transparent with our customers about the security of our UniPDF, UniOffice, and UniHTML libraries. This hub is a key part of that commitment, demonstrating our proactive approach to identifying and addressing security vulnerabilities.

DevSecOps Lifecycle

graph TD
    A[Developer Commits Code] --> B(CI Pipeline Starts);
    subgraph B [Continuous Integration]
        C(Build & Unit Test) --> D{Security Scans};
        subgraph D
            E[SAST Analysis];
            F[Go Package Scan];
            G[Supply Chain Scan];
        end
    end
    D --> H{Vulnerability Found?};
    H -- Yes --> I[Triage & Prioritize];
    I --> J(Remediate Vulnerability);
    J --> A;
    H -- No --> K(Release Secure Product);

Vulnerability Management

graph TD
    A[Discover] --> B(Prioritize);
    B --> C{Remediate};
    C --> D[Verify];
    D --> A;

_{Report generated on: September 27, 2026 at 03:20 UTC}

All Products Vulnerability Report

Covered Products

Key Findings for This Reporting Period

• Total Open Vulnerabilities: Across all products, we are currently tracking 187 open vulnerabilities.
• Progress: Over the last 12 months, we have fixed 22 vulnerabilities, including 0 critical ones.

12-Month Combined Vulnerability Trend

xychart-beta
    title "New vs. Fixed Vulnerabilities (Last 12 Months)"
    x-axis "Month" ["2025-10", "2025-11", "2025-12", "2026-01", "2026-02", "2026-03", "2026-04", "2026-05", "2026-06", "2026-07", "2026-08", "2026-09"]
    y-axis "Count"
    bar "New" [0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0]
    bar "Fixed" [0, 0, 0, 0, 0, 20, 0, 0, 0, 1, 1, 0]

Detailed Vulnerability List

Total Open Vulnerabilities: 187

Total Fixed Vulnerabilities (Last 12 Months): 22

_{Report generated on: September 27, 2026 at 03:20 UTC}

UniPDF Vulnerability Report

Current Status

Total Open Vulnerabilities: 37

12-Month Vulnerability Trend

xychart-beta
    title "New vs. Fixed Vulnerabilities (Last 12 Months)"
    x-axis "Month" ["2025-10", "2025-11", "2025-12", "2026-01", "2026-02", "2026-03", "2026-04", "2026-05", "2026-06", "2026-07", "2026-08", "2026-09"]
    y-axis "Count"
    bar "New" [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
    bar "Fixed" [0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0]

Detailed Vulnerability List

Total Open Vulnerabilities: 37

Total Fixed Vulnerabilities (Last 12 Months): 1

_{Report generated on: September 27, 2026 at 03:20 UTC}

UniOffice Vulnerability Report

Current Status

Total Open Vulnerabilities: 74

12-Month Vulnerability Trend

xychart-beta
    title "New vs. Fixed Vulnerabilities (Last 12 Months)"
    x-axis "Month" ["2025-10", "2025-11", "2025-12", "2026-01", "2026-02", "2026-03", "2026-04", "2026-05", "2026-06", "2026-07", "2026-08", "2026-09"]
    y-axis "Count"
    bar "New" [0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0]
    bar "Fixed" [0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0]

Detailed Vulnerability List

Total Open Vulnerabilities: 74

Total Fixed Vulnerabilities (Last 12 Months): 10

_{Report generated on: September 27, 2026 at 03:20 UTC}

UniHTML Vulnerability Report

Current Status

Total Open Vulnerabilities: 76

12-Month Vulnerability Trend

xychart-beta
    title "New vs. Fixed Vulnerabilities (Last 12 Months)"
    x-axis "Month" ["2025-10", "2025-11", "2025-12", "2026-01", "2026-02", "2026-03", "2026-04", "2026-05", "2026-06", "2026-07", "2026-08", "2026-09"]
    y-axis "Count"
    bar "New" [0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0]
    bar "Fixed" [0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 1, 0]

Detailed Vulnerability List

Total Open Vulnerabilities: 76

Total Fixed Vulnerabilities (Last 12 Months): 11

Supply Chain & Software Bill of Materials

Your security team needs to know exactly what’s in your software supply chain. Here’s everything about ours — the components we ship, how we vet them, and the open tooling that lets you verify it yourself. Nothing here is “trust us”: every claim below points to open-source tooling or public documentation you can inspect and run for yourself.

SBOM — Generated with Syft

A Software Bill of Materials is the ingredient list for a software product. UniDoc produces one for UniPDF and UniOffice on every release using Syft, the widely adopted open-source SBOM generator.

Each SBOM enumerates every direct and transitive dependency — component name, version, license, and dependency relationships — in the two formats enterprise tooling expects.

Supply Chain Risk — Assessed with UniSupply

Knowing what is in the supply chain is only half the job. Before every release we run UniSupply — our own open-source Go supply chain risk scanner — across the full dependency graph of UniPDF and UniOffice. Because it’s open source, you can read exactly how we assess risk and run the same checks against your own projects.

UniSupply evaluates each dependency across nine dimensions:

Findings roll up into a weighted risk score per dependency — vulnerabilities weighted most heavily, then maintenance, dependency depth, maintainer risk, and maturity — with additional penalties for typosquatting and low-resilience packages. Risk signals surface before a release ships, not after a customer flags them.

UniSupply produces reports as text, JSON, PDF, and as CycloneDX (1.5) and SPDX (2.3) SBOMs — and collects no telemetry, transmitting only the module paths already visible in a published go.mod.

Part of a Wider Security Program

SBOMs and dependency scanning are supply-chain controls — but they don’t stand alone. They’re one part of how we manage security across the whole company, governed by our Information Security Management System (ISMS): the documented policies, controls, and review processes behind our day-to-day operations.

Most vendors keep that behind an NDA. We run ours in the open — on isms.sh, the same open-source platform we build and publish at github.com/unidoc/isms:

• Documented in Git — every policy is version-controlled Markdown with full history, so you can see what changed, when, and why.
• Immutable audit trail — reviews and approvals are stamped with a SHA-256 content hash and can’t be quietly rewritten.
• Framework-aligned — mapped to the controls behind ISO 27001, SOC 2, and NIS2, among other standards.
• Open and inspectable — Apache-2.0 licensed, with a live demo at demo.isms.sh.

Coverage: UniPDF and UniOffice only. UniHTML (Chrome runtime) and UniAI (cloud-assisted) have separate supply chain documentation available on request.

Supply chain or vendor assessment questions?
[email protected]