Getoutline Outline — known CVE vulnerabilities

Every CVE whose affected-product data names Getoutline Outline, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (15)

• CVE-2026-33640 — CVSS 9.8 (critical): Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with…
• CVE-2024-37829 — CVSS 8.8 (high): An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in…
• CVE-2026-24901 — CVSS 8.1 (high): Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability…
• CVE-2023-54331 — CVSS 7.8 (high): Outline 1.6.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with…
• CVE-2026-41649 — CVSS 7.7 (high): Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to…
• CVE-2025-64487 — CVSS 7.6 (high): Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the…
• CVE-2024-40626 — CVSS 7.3 (high): Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads…
• CVE-2025-58351 — CVSS 6.8 (medium): Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which…
• CVE-2024-37830 — CVSS 6.1 (medium): An issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state…
• CVE-2026-44695 — CVSS 5.8 (medium): Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET /auth/slack.post…
• CVE-2026-25062 — CVSS 5.5 (medium): Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of…
• CVE-2023-3532 — CVSS 5.4 (medium): Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.
• CVE-2022-2342 — CVSS 5.4 (medium): Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4.
• CVE-2025-68663 — CVSS 5.3 (medium): Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a vulnerability was found in Outline's WebSocket…
• CVE-2026-28506 — CVSS 4.3 (medium): Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving…