O
Vendor security profile1 actively exploited CVEs
onlyoffice
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs8
Critical3
CISA KEV1
Public exploit4
Patch rate%50
Avg. CVSS8.0
12-month vulnerability rate
0
2
0
0
0
0
0
0
0
0
0
2
CVE KEV
CVE severity distribution
8toplam CVE
Critical3 (38%)
High2 (25%)
Medium3 (38%)
Patch and exploitation view
%50
Verified patch
%13
CISA KEV
%50
Public exploit
4Patch available
0Partial
1Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
6.3
CVE-2026-110652
ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass
O
Patch verified
8.7
CVE-2026-110385
Vulnerability in ONLYOFFICE Document Server
O
Patch status unknownEPSS %1
6.5
CVE-2026-84282
A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)
AS
Patch status unknownEPSS %0
6.1
CVE-2025-68936
Cross-site scripting in Onlyoffice Document Server
O
Patch status unknownEPSS %0
6.1
CVE-2025-68935
Cross-site scripting in Onlyoffice Document Server
O
Patch status unknownEPSS %0
7.5
CVE-2023-30188
Vulnerability in Onlyoffice Document Server
O
Patch verifiedEPSS %2
9.8
CVE-2023-30187
Out-of-bounds write in Onlyoffice Document Server
O
Patch verifiedEPSS %2
9.8
CVE-2023-30186
Use after free in Onlyoffice Document Server
O
Patch verifiedEPSS %2
9.8
CVE-2021-3199 Actively exploited
Path traversal in N/a
N
WorkaroundEPSS %19