CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Critical RCE in Nextcloud Collabora Online Built-in CODE Server (CVE-2026-110447)
[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands, leading to full system compromise.
[Mitigation] Update the richdocumentscode app to version 26.4.303 or later immediately.
Collabora Online Built-in CODE Server (richdocumentscode) Proxy OS Command Injection and Remote Code Execution (RCE) Vulnerability (CVE-2025-66208)
[Affected Scope] Nextcloud deployments utilizing the Collabora Online - Built-in CODE Server (richdocumentscode) app prior to version 25.04.702
[Impact] Unauthenticated attackers can exploit a configuration-dependent OS Command Injection vulnerability via proxy.php and an intermediate reverse proxy to achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade the richdocumentscode application to version 25.04.702 or later, and restrict external access to the proxy endpoint in the interim