Collabora

Mentions · 7d0
Mentions · 30d8
All mentions9
First seenSep 11, 2026
Last mentioned9d ago

Timeline

9 articles · newest first

CISA lists exploited Collabora Online flaw CVE-2026-110447

Unauthenticated attackers can run OS commands as the web server user when the built-in CODE server is stopped; fix is 26.4.303.

Security AffairsOct 24, 16:53 UTC · 9d agoExploit / PoCExploitedCVE-2026-1104476 · 5 reads

CISA adds exploited Collabora Online and VeloCloud flaws to KEV

FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.

The Hacker NewsOct 24, 06:25 UTC · 9d agoExploit / PoCExploitedCVE-2026-110447 CVE-2026-1146254

CISA lists exploited Collabora Online command injection in KEV

CVE-2026-110447 in Collabora Online's built-in CODE Server is actively exploited; FCEB agencies must prioritize fixes.

CISA AdvisoriesOct 23, 12:00 UTC · 10d agoExploit / PoCExploitedCVE-2026-1104471 · 1 read

CISA lists exploited Collabora CODE Server command injection

Versions before 26.4.303 allow remote code execution when the built-in CODE server is not running.

CISA Known Exploited VulnerabilitiesOct 23, 00:00 UTC · 10d agoExploit / PoCExploitedCVE-2026-1104471

Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers

Attackers are exploiting CVE-2026-110447 in Nextcloud's Collabora CODE app to plant web shells.

Cyber Security NewsOct 17, 05:24 UTC · 16d agoExploit / PoCExploitedCVE-2026-110447 CVE-2025-662088 · 4 reads

Critical Collabora Online Flaw Lets Attackers Execute Commands on Nextcloud Servers

Unauthenticated command injection CVE-2026-110447 in Nextcloud's built-in Collabora CODE Server can run commands as the web user.

GBHackersOct 16, 09:19 UTC · 17d agoVulnerabilityCVE-2026-110447 CVE-2025-6620810 · 4 reads

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Attackers are exploiting CVE-2026-110447 in Nextcloud's built-in Collabora app to plant webshells and hunt credentials.

BleepingComputerOct 15, 20:25 UTC · 17d agoExploit / PoCExploitedCVE-2026-1104473 · 1 read

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited CVE-2026-110447 in Nextcloud's optional Collabora CODE app to plant web shells.

The Hacker NewsOct 14, 17:38 UTC · 19d agoExploit / PoCExploitedCVE-2025-66208 CVE-2026-1104475

Re-Engineering YouTube for the Living Room: Bringing "Chrobalt" to RDK

Collabora and Google built the first RDK-based Chrobalt reference platform, re-architecting YouTube's Cobalt web engine on Chromium for smart TVs.

Hacker News · securitySep 11, 13:41 UTC · Sep 11, 2026Other HN 20 points · 9 comments3 · 1 read

Related CVEs

by mentions

CVE-2026-11044773%9.2
Unauthenticated OS command injection in Nextcloud CODE Server
published 19d agoCollabora Online Built-in CODE Server (richdocumentscode Nextcloud app)KEVPoC ×3
CVE-2025-662081%7.2
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online
published Dec 3, 2025collabora collabora online - built-in code server
CVE-2026-1146251%9.4
SQL injection in Arista VeloCloud Orchestrator grants superuser
published 10d agoArista VeloCloud OrchestratorKEVPoC

Appears with

Collabora Onlineproduct · 6
richdocumentscodeproduct · 5
Nextcloudproduct · 5
Nextcloudvendor · 5
CISAorganization · 4
Nextcloudorganization · 3
Collaboraorganization · 2
RDKproduct · 1
Cobaltproduct · 1
CODE Serverproduct · 1
Googlevendor · 1
Aristavendor · 1
Nextcloud Officeproduct · 1
Collabora Online - Built-in CODE Serverproduct · 1
Chromiumproduct · 1
Collabora Online Built-in CODE Serverproduct · 1

Entities are extracted by the model from each article. First seen Sep 11, 2026, last mentioned 9d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.