ONLYOFFICE Document Server

• CVE-2026-110385 High 8.7 A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system comma 1.0%
• CVE-2025-68936 Medium 6.4 ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. 0.2%
• CVE-2025-68935 Medium 6.4 ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer. 0.2%
• CVE-2025-68917 Medium 6.4 ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer. 0.2%