OOutline

Products

Exploited and recent CVEs

• CVE-2026-120489 Medium 4.3 Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft 0.2%
• CVE-2026-120449 Medium 5.3 Outline before 1.12.0 Improper Access Control via Public Document Shares 0.4%
• CVE-2026-113611 Medium 4.9 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions 0.5%
• CVE-2026-54573 Medium 5.3 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy 0.5%
• CVE-2026-44695 Medium 5.8 Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity 0.1%
• CVE-2026-43889 Medium 6.5 Outline: Unauthorized Document Publication via Mixed collectionId+documentId Share 0.2%
• CVE-2026-43888 High 8.7 Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import 0.4%
• CVE-2026-43890 High 7.7 Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7) 0.2%
• CVE-2026-43886 High 8.2 Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access 0.2%
• CVE-2026-43887 High 7.3 Outline: Stored XSS via Comment Mentions 0.2%
• CVE-2026-41649 High 7.7 Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces 0.3%
• CVE-2026-33640 Critical 9.1 Outline has a rate limit bypass that allows brute force of email login OTP 0.5%
• CVE-2026-28506 Medium 4.3 Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts 0.2%
• CVE-2026-24901 High 8.1 Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts 0.3%
• CVE-2025-68663 Medium 6.9 Outline has a suspended user authentication bypass via WebSocket connections 0.3%
• CVE-2025-64487 High 7.6 Outline is vulnerable to privilege escalation vulnerability in document sharing 0.2%
• CVE-2026-25062 Medium 5.5 Outline Affected an Arbitrary File Read via Path Traversal in JSON Import 0.4%
• CVE-2025-58351 Medium 6.8 Outline's Local File Storage Feature can Cause CSP Bypass 0.4%
• CVE-2024-40626 High 7.3 Stored Cross-site Scripting (XSS) vulnerability in Outline editor 0.5%
• CVE-2023-3532 High 8.5 Cross-site Scripting (XSS) - Stored in outline/outline 0.5%
• CVE-2022-2342 High 7.3 Cross-site Scripting (XSS) - Stored in outline/outline 0.7%