Log in Start free

ONLYOFFICE

Products

ProductCVEsExploitedLatest
Document Server4–Oct 14, 2026
ONLYOFFICE Docs2–Jul 24, 2025
Docs (DocumentServer)1–Jun 12, 2025
DocumentServer1–Oct 14, 2026
ONLYOFFICE DocSpace1–Dec 12, 2024
Workspace1–Feb 7, 2023

Exploited and recent CVEs

  • CVE-2026-110652 Medium 4.0 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass 0.4%
  • CVE-2026-110385 High 8.7 A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system comma 1.0%
  • CVE-2025-68936 Medium 6.4 ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. 0.2%
  • CVE-2025-68935 Medium 6.4 ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer. 0.2%
  • CVE-2025-68917 Medium 6.4 ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer. 0.2%
  • CVE-2025-6380 Critical 9.8 ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function 0.9%
  • CVE-2025-5301 Medium 6.1 Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer) 62.4%
  • CVE-2024-11750 Medium 6.4 ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2024-11450 Medium 6.4 ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2022-47412 Medium 5.4 ONLYOFFICE Workspace Search Stored XSS 0.6%