ONLYOFFICE Document Server vulnerabilities
4 published CVEs name ONLYOFFICE Document Server among the affected products.
- Published CVEs
- 4
- Last 12 months
- 4
- Critical
- 0
- Known exploited
- 0
Critical 0High 1Medium 3Low 0Not scored 0
CVEs per yearBy the year they were published
- 20253
- 20261
Newest CVEs
- CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to…
ONLYOFFICE · Document Server
High8.7 - CVE-2025-68936
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
ONLYOFFICE · Document Server
Medium6.4 - CVE-2025-68935
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
ONLYOFFICE · Document Server
Medium6.4 - CVE-2025-68917
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
ONLYOFFICE · Document Server
Medium6.4