ONLYOFFICE

Mentions · 7d0
Mentions · 30d2
All mentions3
First seenSep 8, 2026
Last mentioned19d ago

Timeline

3 articles · newest first

U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog

CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.

Security AffairsOct 11, 09:18 UTC · 19d agoExploit / PoCExploitedCVE-2015-3306 CVE-2021-3199 CVE-2023-22894+214 · 3 reads

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.

The Hacker NewsOct 9, 12:21 UTC · 21d agoExploit / PoCExploitedCVE-2015-3306 CVE-2021-3199 CVE-2023-22894+514 · 5 reads

VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

ONLYOFFICE's ownCloud integration plugin 9.12 has an SSRF flaw (CVE-2026-84282) letting authenticated admins probe internal networks; no patch exists yet.

CERT/CC Vulnerability NotesSep 8, 14:23 UTC · Sep 8, 2026VulnerabilityCVE-2026-842822 · 2 reads

Related CVEs

by mentions

CVE-2015-330699%10.0
Arbitrary file read/write via ProFTPD 1.3.5 mod_copy
published May 18, 2015ProFTPDKEVPoC ×5
CVE-2021-319930%9.8
Path Traversal RCE in ONLYOFFICE Document Server
published Jan 26, 2021ONLYOFFICE Document Server (ONLYOFFICE Docs)KEVPoC ×2
CVE-2016-308197%8.1
Command injection RCE in Apache Struts Dynamic Method Invocation
published Apr 26, 2016Apache StrutsKEVPoC ×2
CVE-2015-5477100%7.5
Remote denial of service in ISC BIND via TKEY queries
published Jul 29, 2015ISC BINDKEV
CVE-2023-228944%4.9
Sensitive-data leak in Strapi admin query filters (through 4.5.5)
published Apr 19, 2023StrapiKEVPoC ×2
CVE-2019-11510100%10.0
Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
published May 8, 2019Ivanti Pulse Connect SecureKEVRansomwarePoC ×2
CVE-2021-22205100%10.0
Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205)
published Apr 23, 2021GitLab Community Edition (CE) and Enterprise Edition (EE), self-managedKEVRansomwarePoC ×2
CVE-2014-6278100%—
Remote OS Command Injection in GNU Bash via Crafted Environment (Shellshock-family)
published —GNU BashKEV
CVE-2026-84282<1%6.5
SSRF in ONLYOFFICE ownCloud Integration plugin 9.12
published Sep 8, 2026ONLYOFFICE ownCloud Integration plugin

Appears with

CISAorganization · 2
Strapivendor · 2
Microsoft Exchangeproduct · 2
ONLYOFFICE Docsproduct · 2
ISCvendor · 2
Strapiproduct · 2
ProFTPDproduct · 2
Microsoftvendor · 2
Apache Strutsproduct · 2
Apachevendor · 2
BINDproduct · 1
CERT/CCorganization · 1
Ascensio System SIAvendor · 1
Flax Typhoonthreat actor · 1
ownCloudvendor · 1
FishHubmalware · 1

Entities are extracted by the model from each article. First seen Sep 8, 2026, last mentioned 19d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.