Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Critical | 9.2 | CVE-2026-110447 |
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October...
CollaboraCollabora Online – Built-in CODE Server
|
NVD | KEV | ||
|
CVE-2026-110447Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October...
From the advisoryCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.2 | CVE-2026-110447 |
CVE-2026-110447 added to KEV: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora, NextcloudCollabora Online – Built-in CODE Server, Collabora Online, Nextcloud Collabora Online - Built-in CODE Server, Nextcloud richdocumentscode
|
CISA KEV | KEV | ||
|
CVE-2026-110447CVE-2026-110447 added to KEV: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Executive summaryA command injection flaw in the Collabora Online Built-in CODE Server app for Nextcloud is being actively exploited, and attackers have planted web shells on some servers. The advisory says it is severe and tells administrators to update the app right away. Collabora itself is not affected, according to the advisory. Technical summaryThe flaw is an OS command injection in the richdocumentscode app, which starts Collabora through a PHP exec call. Exploitation is reported in the wild, with users finding web shells on Nextcloud servers. The advisory lists richdocumentscode v26.4.302 and older as affected and says the issue is fixed in richdocuments .303, though the exact fixed richdocumentscode version is not stated. Docker, Linux distribution packages, and hosted Collabora services are listed as not affected, and the advisory names a severity of 9.2 out of 10. No workaround is stated beyond removing the app, and a user reports that an extra file Nx_33143.php appeared in the app directory, which the integrity check flagged. Administrators should review access logs for proxy.php?status requests and hunt for unexpected PHP files, but the advisory does not give formal detection guidance, and the CVSS vector is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsCollaboraNextcloudCollabora Online – Built-in CODE ServerCollabora OnlineNextcloud Collabora Online - Built-in CODE ServerNextcloud richdocumentscode
CISA Known Exploited Vulnerabilities CatalogPublished
Read the advisory
|
|||||||