Known Vulnerabilities for products from Onlyoffice
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Onlyoffice".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-38587 json | Not Provided | 2026-05-26 | 2026-05-26 | |
| CVE-2023-34939 json | Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the comp... | 9.8 - CRITICAL | 2023-06-22 | 2023-06-28 |
| CVE-2023-30188 json | Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial o... | Not Provided | 2023-08-14 | 2026-07-09 |
| CVE-2023-30187 json | An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run ... | Not Provided | 2023-08-14 | 2026-07-09 |
| CVE-2023-30186 json | A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary c... | Not Provided | 2023-08-14 | 2026-07-09 |
| CVE-2022-48422 json | ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.... | 7.8 - HIGH | 2023-03-19 | 2023-08-08 |
| CVE-2022-47412 json | Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "T... | 5.4 - MEDIUM | 2023-02-07 | 2023-03-16 |
| CVE-2022-29777 json | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the co... | 9.8 - CRITICAL | 2022-06-02 | 2022-12-09 |
| CVE-2022-29776 json | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the c... | 9.8 - CRITICAL | 2022-06-02 | 2022-12-09 |
| CVE-2022-24229 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 6.1 - MEDIUM | 2022-04-08 | 2022-04-14 |
| CVE-2021-43449 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 8.1 - HIGH | 2023-01-23 | 2023-01-31 |
| CVE-2021-43448 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 5.3 - MEDIUM | 2023-01-23 | 2023-01-31 |
| CVE-2021-43447 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7.5 - HIGH | 2023-01-23 | 2023-08-08 |
| CVE-2021-43446 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 6.1 - MEDIUM | 2023-01-23 | 2023-01-31 |
| CVE-2021-43445 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 9.8 - CRITICAL | 2023-01-23 | 2023-01-31 |
| CVE-2021-43444 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7.5 - HIGH | 2023-01-23 | 2023-01-31 |
| CVE-2021-40864 json | The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data a... | 9.8 - CRITICAL | 2021-09-10 | 2021-09-24 |
| CVE-2021-25833 json | A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file exten... | 9.8 - CRITICAL | 2021-03-01 | 2021-03-15 |
| CVE-2021-25832 json | A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v... | 9.8 - CRITICAL | 2021-03-01 | 2021-03-15 |
| CVE-2021-25831 json | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must req... | 9.8 - CRITICAL | 2021-03-01 | 2021-03-15 |
Known software with vulnerabilities from Onlyoffice
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Onlyoffice | Document Server | 3.0.0 |