■ ARISTA CVE-2026-114625 · Fixed■ CISCO CVE-2026-76519 · Fixed■ CITRIX CVE-2026-88779 · Fixed■ COLLABORA CVE-2026-110447 · Fixed■ FORTINET CVE-2026-104286 · Fixed■ GITLAB CVE-2026-97229 · Fixed■ MICROSOFT KB5127648 · Confirmed by Microsoft (Oct 20)■ MICROSOFT KB5127648 · Fixed in October 13 updates■ ORACLE CVE-2026-75803 · Released 2026-10-20■ PALO ALTO CVE-2026-0322 · Fixed■ PALO ALTO CVE-2026-109618 · Fixed■ PLEX CVE-2026-96652 · Fixed■ SAP GHSA-4mv3-jxxm-9cx2 · Patches released 2026-10-13■ SONICWALL CVE-2026-19868 · Fixed■ VMWARE/BROADCOM KB 455737 · No critical release in October■ MICROSOFT KB5124010 · Mitigated (workaround only■ WORDPRESS CVE-2026-119977 · Fixed

← All impacts

Collabora

Collabora Online Built-in CODE Server: exploited unauthenticated command injection (CVE-2026-110447)

Fixed

TL;DR: The Collabora Online Built-in CODE Server, the Nextcloud richdocumentscode app, has an unauthenticated OS command injection flaw. The vendor rates it Critical, 9.2 under CVSS v4.0. CISA added it to KEV on Oct 23. Disabling the app isn't enough: upgrade to 26.4.303 or remove it. (GHSA, CISA KEV)

Item Detail Source
CVE / severity CVE-2026-110447, vendor-rated Critical 9.2 (CVSS v4.0) GHSA
Affected Collabora Online Built-in CODE Server (Nextcloud richdocumentscode) GHSA
Impact Unauthenticated OS command injection GHSA
Exploitation CISA KEV add Oct 23 CISA KEV
Fix Upgrade to 26.4.303, or remove the app. Disabling it is not enough GHSA
Last verified 2026-10-23Report an error: [email protected]