Vendor hub

Collabora vulnerabilities

Dossiers

CVE-2026-110447CRITICAL

Unauthenticated OS command injection in the Nextcloud Built-in CODE Server app, exploited since 2026-09-10 to drop PHP web shells.

Updated 2026-11-11

CVE	Product	Added to KEV	Status	Dossier
CVE-2026-110447	Collabora Online – Built-in CODE Server	2026-10-23	Active exploitation	Read →