Advisories · Technology

online.

Every CVE that names online among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-46499 CVE record

CVSS 4.3 Medium

Collabora Online: Read-only session authorization bypass permits live document edits
- online
- Broken access control
Not analysed yet 30 Oct 2026
CVE-2026-48164 CVE record

CVSS 4.7 Medium

Collabora Online: Reflected HTML injection through host_session_id
- online
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2026
CVE-2026-23623 CVE record

CVSS 5.3 Medium

Collabora Online vulnerable to Authorization Bypass
- online
- Broken access control
Not analysed yet 5 Feb 2026
CVE-2025-66208 CVE record

CVSS 7.2 High

Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
- online
- Command injection
Not analysed yet 3 Dec 2025
CVE-2025-27791 CVE record

CVSS 8.3 High

Collabora Online Vulnerable to Arbitrary File Write
- online
- Path traversal
Not analysed yet 15 Apr 2025
CVE-2025-24796 CVE record

CVSS 6.3 Medium

Remote Code Execution within Collabora Online jail with Macros Enabled
- online
- CWE-829
Not analysed yet 6 Mar 2025
CVE-2024-45045 CVE record

CVSS 6.3 Medium

JavaScript Injection via url encoded values in links in Collabora Office Android
- online
- CWE-84
Not analysed yet 29 Aug 2024
CVE-2024-37311 CVE record

CVSS 8.2 High

Collabora Online's remote host TLS certificates are not fully verified
- online
- Weak cryptography or TLS
Not analysed yet 23 Aug 2024
CVE-2024-29182 CVE record

CVSS 6.1 Medium

Collabora Online Stored Cross-Site-Scripting vulnerability via tooltip
- online
- Cross-site scripting (XSS)
Not analysed yet 4 Apr 2024
CVE-2024-25114 CVE record

CVSS 2.6 Low

Sensitive Information Disclosure (JailID) to users in Collabora Online
- online
- Information disclosure
Not analysed yet 11 Mar 2024
CVE-2023-49782 CVE record

CVSS 7.1 High

Cross-Site-Scripting vulnerability in error message passing in richdocumentscode
- online
- Cross-site scripting (XSS)
Not analysed yet 8 Dec 2023
CVE-2023-49788 CVE record

CVSS 7.2 High

Improper handling of browser-side provided input in richdocuments path handling
- online
- Path traversal
- CWE-501
Not analysed yet 8 Dec 2023
CVE-2023-48314 CVE record

CVSS 7.1 High

Unescaped passing of the request URL in Collabora Online
- online
- Cross-site scripting (XSS)
Not analysed yet 1 Dec 2023
CVE-2023-34088 CVE record

CVSS 8.7 High

Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface
- online
- Cross-site scripting (XSS)
Not analysed yet 31 May 2023
CVE-2023-31145 CVE record

CVSS 4.3 Medium

Reflected XSS vulnerability in CollaboraOnline
- online
- Cross-site scripting (XSS)
Not analysed yet 15 May 2023
CVE-2021-43817 CVE record

CVSS 8.2 High

Reflected Cross-Site-Scripting vulnerability in Collabora Online
- online
- Cross-site scripting (XSS)
Not analysed yet 13 Dec 2021
CVE-2021-32745 CVE record

CVSS 7.3 High

Reflected Cross-Site-Scripting vulnerability
- online
- Cross-site scripting (XSS)
Not analysed yet 21 Jul 2021
CVE-2021-32744 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Unauthenticated attacker could gain access to currently open files
- online
- Broken access control
Not analysed yet 21 Jul 2021