Business and collaboration apps: vulnerabilities and fixes

Zoom, Slack, Confluence, Jira, SAP, Salesforce, Adobe and remote support tools. 123 CVEs tracked.

Business and collaboration apps has 123 tracked vulnerabilities, 18 critical and 9 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 89. Most recent: 2026-10-24. Highest priority: CVE-2023-49105 (score 97/100).

• CVE-2023-49105 CRITICAL 9.8 EXPLOITED UPGRADE ownCloud Improper Authentication Vulnerability
• CVE-2026-110447 CRITICAL 9.2 EXPLOITED MITIGATE Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
• CVE-2026-21589 HIGH 7.5 EXPLOITED UPGRADE UPGRADE Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
• CVE-2026-65660 HIGH 8.8 EXPLOITED UPGRADE Microsoft SharePoint Code Injection Vulnerability
• CVE-2026-84869 CRITICAL 9.9 EXPLOITED UPGRADE ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
• CVE-2026-6516 CRITICAL 10.0 Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution
• CVE-2026-12571 CRITICAL 9.8 An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
• CVE-2026-96656 HIGH 7.2 EXPLOITED UPGRADE Plex Media Server External Control of File Name or Path Vulnerability
• CVE-2026-96654 MEDIUM 6.5 EXPLOITED UPGRADE Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
• CVE-2026-65667 CRITICAL 10.0 MITIGATE Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-58231 CRITICAL 10.0 SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit spec
• CVE-2026-109444 CRITICAL 9.8 OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute
• CVE-2026-34265 CRITICAL 9.8 SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG pro
• CVE-2026-70321 HIGH 8.8 UPGRADE Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code
• CVE-2026-96652 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-29198 CRITICAL 9.8 UPGRADE In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulne
• CVE-2026-70332 CRITICAL 9.6 MITIGATE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Share
• CVE-2026-62896 CRITICAL 9.6 MITIGATE Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
• CVE-2026-65768 HIGH 8.8 UPGRADE Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android
• CVE-2026-70326 HIGH 8.8 UPGRADE Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate pri
• CVE-2026-70476 HIGH 8.2 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-96655 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-47705 CRITICAL 9.6 TypeBot is a chatbot builder tool
• CVE-2026-65767 HIGH 8.8 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for An
• CVE-2026-62918 HIGH 7.5 MITIGATE Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform
• CVE-2026-72535 HIGH 8.6 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attacke
• CVE-2026-72536 HIGH 8.6 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attacke
• CVE-2023-23917 HIGH 8.8 UPGRADE A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE
• CVE-2026-44758 CRITICAL 9.1 SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit special
• CVE-2026-48616 CRITICAL 9.3 UPGRADE Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerab
• CVE-2026-48929 HIGH 7.5 UPGRADE Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to
• CVE-2026-47724 CRITICAL 9.9 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-57105 HIGH 8.0 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Share
• CVE-2026-93471 HIGH 8.7 Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an u
• CVE-2026-54638 HIGH 7.5 gotd/td is a T Telegram MTProto API client in Go
• CVE-2026-112380 CRITICAL 9.9 Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of
• CVE-2026-59545 HIGH 8.1 Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.
• CVE-2026-65769 MEDIUM 6.5 UPGRADE Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized at
• CVE-2026-73031 HIGH 8.7 telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute a
• CVE-2026-86696 HIGH 8.2 Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthe
• CVE-2026-105270 HIGH 8.7 Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an
• CVE-2026-67428 HIGH 8.5 Flyto2 Core is an execution kernel for automation and AI-agent workflows
• CVE-2026-32995 HIGH 7.5 The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5,
• CVE-2026-49258 HIGH 8.8 Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN
• CVE-2026-47722 HIGH 8.7 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-48025 MEDIUM 6.9 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-58243 HIGH 8.8 SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing
• CVE-2026-73498 HIGH 7.7 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)
• CVE-2026-53413 HIGH 8.3 Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a mee
• CVE-2026-53415 HIGH 8.3 Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote cod
• CVE-2026-91492 HIGH 8.7 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP
• CVE-2026-44765 HIGH 7.3 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unaut
• CVE-2026-48494 HIGH 7.1 TypeBot is a chatbot builder tool
• CVE-2026-59530 HIGH 7.5 Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
• CVE-2026-44764 HIGH 7.3 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unaut
• CVE-2026-47726 HIGH 7.1 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-56835 HIGH 8.3 PraisonAI is a multi-agent teams system
• CVE-2026-62192 HIGH 8.1 UPGRADE OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild acti
• CVE-2023-28325 MEDIUM 6.5 UPGRADE An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the
• CVE-2026-47723 HIGH 7.1 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-44763 HIGH 7.6 SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path
• CVE-2026-47725 MEDIUM 6.9 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-58230 HIGH 7.0 UPGRADE SAP Approuter does not sufficiently validate certain token content under specific configurations
• CVE-2026-58238 MEDIUM 5.9 UPGRADE SAP Approuter does not sufficiently handle certain requests under specific conditions
• CVE-2026-68813 MEDIUM 5.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-115932 CRITICAL 9.6 When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk,
• CVE-2026-40130 MEDIUM 5.3 SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands
• CVE-2026-56832 HIGH 8.8 PraisonAI is a multi-agent teams system
• CVE-2026-66660 MEDIUM 6.5 Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
• CVE-2026-98555 HIGH 7.5 In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr
• CVE-2026-70310 MEDIUM 5.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-73291 HIGH 7.1 Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby
• CVE-2026-58236 MEDIUM 5.5 SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missi
• CVE-2026-58248 MEDIUM 6.5 SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to uplo
• CVE-2026-62206 HIGH 7.1 UPGRADE OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions
• CVE-2026-58247 MEDIUM 5.3 SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component
• CVE-2026-66778 MEDIUM 5.3 UPGRADE SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal com
• CVE-2026-67329 HIGH 7.1 @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an autho
• CVE-2026-115975 HIGH 7.1 Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit
• CVE-2026-28169 MEDIUM 5.3 Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
• CVE-2026-53414 MEDIUM 6.5 Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meet
• CVE-2026-66763 HIGH 7.9 SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user o
• CVE-2026-66777 MEDIUM 5.9 UPGRADE SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend desti
• CVE-2026-61960 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
• CVE-2026-66779 MEDIUM 6.3 Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated a
• CVE-2026-115450 HIGH 7.1 External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01
• CVE-2026-53416 HIGH 7.1 Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosur
• CVE-2026-48058 MEDIUM 4.6 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-58235 MEDIUM 6.3 SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and dat
• CVE-2026-67530 MEDIUM 6.4 WACRM is a self-hostable CRM template for WhatsApp
• CVE-2026-113799 MEDIUM 5.3 Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit
• CVE-2026-65518 MEDIUM 6.5 Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
• CVE-2026-66641 MEDIUM 6.5 Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
• CVE-2026-66770 MEDIUM 6.3 Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inj
• CVE-2026-34951 MEDIUM 6.1 UPGRADE Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations
• CVE-2026-48483 MEDIUM 5.4 TypeBot is a chatbot builder tool
• CVE-2026-58237 MEDIUM 5.9 UPGRADE WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality
• CVE-2026-58239 LOW 3.7 UPGRADE SAP Approuter does not sufficiently validate tenant context in inbound requests
• CVE-2026-66774 LOW 3.7 UPGRADE SAP Approuter does not consistently handle certain error conditions
• CVE-2026-109935 MEDIUM 5.3 The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a publis
• CVE-2026-66760 MEDIUM 6.4 UPGRADE SAP Approuter does not correctly validate client certificates in certain callback flows
• CVE-2025-14714 MEDIUM 6.5 UPGRADE An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inhe
• CVE-2026-66761 MEDIUM 4.3 UPGRADE SAP Approuter does not enforce sufficient flow control in certain functionality
• CVE-2026-66776 MEDIUM 5.9 UPGRADE SAP Approuter does not consistently enforce integrity verification on certain session-related request headers
• CVE-2026-72918 MEDIUM 5.4 Rocket.Chat is an open-source, secure, fully customizable communications platform
• CVE-2026-13411 MEDIUM 4.3 Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions
• CVE-2026-29197 MEDIUM 4.3 UPGRADE In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /ap
• CVE-2026-66772 MEDIUM 4.3 SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization ch
• CVE-2026-72919 MEDIUM 4.3 Rocket.Chat is an open-source, secure, fully customizable communications platform
• CVE-2026-28736 MEDIUM 4.3 DOWNGRADE ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded
• CVE-2026-47768 MEDIUM 5.5 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-58244 MEDIUM 4.3 SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain
• CVE-2026-66764 MEDIUM 4.3 Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenti
• CVE-2026-19369 MEDIUM 5.3 A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0
• CVE-2026-58241 MEDIUM 4.2 SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a
• CVE-2026-58246 MEDIUM 4.3 SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information in
• CVE-2026-58245 LOW 3.8 SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source
• CVE-2026-66775 MEDIUM 4.3 UPGRADE SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default
• CVE-2026-114072 MEDIUM 4.3 The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-l
• CVE-2026-18028 LOW 2.3 The "quick setup" view presented to users after they first create an event allows to set up the most critical
• CVE-2026-44762 LOW 3.7 SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration a
• CVE-2026-115724 LOW 2.9 VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() tha
• CVE-2026-98902 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq compari

FAQ

How do I fix Business and collaboration apps vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Business and collaboration apps being exploited right now?

Yes: 9 Business and collaboration apps CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Business and collaboration apps CVE should I patch first?

CVE-2023-49105 currently ranks highest (97/100): ownCloud Improper Authentication Vulnerability.

Software in this group

People search for: zoom, slack, confluence, jira, sap, adobe, anydesk.

← Back to latest CVEs