Onlyoffice Documentserver vulnerabilities

• onlyoffice documentserver ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass CVE-2026-110652 6.3 MediumOctober 14, 2026
• onlyoffice docs (documentserver) Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer) CVE-2025-5301 EPSS 62.4% 6.1 MediumJune 12, 2025