{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:30.887Z","products":["collabora"],"actNowTotal":1,"results":[{"query":"collabora","matched":1,"actNow":1,"events":[{"id":"kev-2026-10-23-collabora-collabora-online-built-in-code","url":"https://securitythreatpulse.com/events/kev-2026-10-23-collabora-collabora-online-built-in-code","title":"Collabora Online, Built-in CODE Server: attackers can run commands on it","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 28 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (9.2). The exploit prediction score is 73%.","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public.","The confirmation is 19 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-110447"],"vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","affectedProducts":[{"kind":"direct","slug":"collabora/collaboraonlinebuiltincodeserver","vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","evidence":["kev","cpe"],"vendorKey":"collabora","productKey":"collaboraonlinebuiltincodeserver"}],"category":{"id":"collaboration","label":"Documents and collaboration","why":"It holds shared documents and internal pages.","doThis":"Patch it, or ask your provider whether they have."},"summary":"Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.","cvss":9.2,"epss":0.73307,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-23","kevDueDate":"2026-10-26","firstSeenAt":"2026-10-23T00:00:00.000Z","updatedAt":"2026-11-11T02:30:23.338Z","newestEvidenceAt":"2026-11-05T17:47:13.081Z"}]}]}