SE
Product
security-advisories
87
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 12Medium 62Low 12
Watch
Add security-advisories to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-66510 | 4.9 | Dec 5 | Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list Affected: >= 32.0.0beta1, < 32.0.1; < 31.0.10 |
| CVE-2022-31119 | 4.9 | Aug 4 | Password disclosure in log file in Nextcloud Mail App Affected: < 1.12.1 |
| CVE-2024-37886 | 4.7 | Jun 14 | Nextcloud user_oidc's ID4me does not validate signature or expiration Affected: < 1.3.5 |
| CVE-2026-45153 | 4.6 | Jun 1 | Nextcloud: PIN bypass in PassCodeActivity via back button Affected: >= 33.0.0, < 33.1.0 |
| CVE-2024-37317 | 4.6 | Jun 14 | Nextcloud Notes app can be tricked into using a received share created before the user logged in Affected: >= 4.6.0, < 4.9.3 |
| CVE-2024-37316 | 4.6 | Jun 14 | Nextcloud Calendar's event create can create attachments that link to other websites Affected: >= 4.3.0, < 4.6.8; >= 4.7.0, < 4.7.2 |
| CVE-2026-45544 | 4.3 | Jun 1 | Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService Affected: >= 0.8.0, < 1.0.4 |
| CVE-2026-45286 | 4.3 | Jun 1 | Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint Affected: >= 5.5.13, < 5.5.17; >= 6.2.0, < 6.2.3 |
| CVE-2026-45283 | 4.3 | Jun 1 | Nextcloud: Files Lock app allows users to lock and unlock files of other users Affected: >= 32.0.0, < 32.0.2; >= 33.0.0, < 33.0.1 |
| CVE-2026-45264 | 4.3 | Jun 1 | Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames Affected: >= 17.0.0, < 17.0.15; >= 18.0.0, < 18.1.12; >= 19.0.0, < 19.1.16; >= 20.0.0, < 20.1.11; >= 21.0.0, < 21.0.4 |
| CVE-2025-66558 | 4.3 | Dec 5 | Nextcloud Twofactor WebAuthn app was updated based on public key Affected: < 1.4.2; >= 2.0.0-beta.1, < 2.4.1 |
| CVE-2025-66556 | 4.3 | Dec 5 | Nextcloud talk allows participants to blindly delete poll drafts of other users by ID Affected: < 20.1.8; >= 21.0.0-beta.1, < 21.1.2 |
| CVE-2025-66545 | 4.3 | Dec 5 | Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin Affected: < 14.0.11; >= 15.0.0-beta1, < 15.3.12; >= 16.0.0, < 16.0.15; >= 17.0.0-beta.1, < 17.0.14; >= 18.0.0-beta.1, < 18.1.8; >= 19.0.0-alpha.1, < 19.1.8; +1 more |
| CVE-2025-66557 | 4.3 | Dec 5 | Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners Affected: >= 1.15.0-beta.1, < 1.15.2; < 1.14.6 |
| CVE-2025-66553 | 4.3 | Dec 5 | Nextcloud Tables app allowed users to view columns metadata information of any table Affected: >= 0.9.0-beta.1, < 0.9.4; < 0.8.7 |
| CVE-2025-66551 | 4.3 | Dec 5 | Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users Affected: >= 0.9.0-beta.1, < 0.9.3; < 0.8.6 |
| CVE-2025-66552 | 4.3 | Dec 5 | Nextcloud Server admin_audit does not log all actions on files in groupfolders Affected: >= 32.0.0beta1, < 32.0.1; < 31.0.9 |
| CVE-2025-66547 | 4.3 | Dec 5 | Nextcloud Server users can modify tags on files that do not belong to them Affected: < 31.0.1 |
| CVE-2025-47794 | 4.3 | May 16 | Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission Affected: >= 26.0.0, < 26.0.13.13; >= 27.0.0, < 27.1.11.13; >= 28.0.0, < 28.0.14.4; >= 29.0.0, < 29.0.13; >= 30.0.0, < 30.0.7; >= 31.0.0, < 31.0.1 |
| CVE-2024-52507 | 4.3 | Nov 15 | Share information of the Nextcloud Tables app is not limited to affected users Affected: >= 0.3.0, < 0.8.1 |
| CVE-2024-52513 | 4.3 | Nov 15 | Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares Affected: >= 28.0.0, < 28.0.11; >= 29.0.0, < 29.0.8; >= 30.0.0, < 30.0.1 |
| CVE-2024-52516 | 4.3 | Nov 15 | Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them Affected: >= 28.0.0, < 28.0.9; >= 29.0.0, < 29.0.5 |
| CVE-2024-37883 | 4.3 | Jun 14 | Nextcloud Deck can access comments and attachments of deleted cards Affected: >= 1.6.0, < 1.6.6; >= 1.7.0, < 1.7.5; >= 1.8.0, < 1.8.7; >= 1.9.0, < 1.9.6; >= 1.10.0, < 1.11.3; >= 1.11.0, < 1.12.1 |
| CVE-2024-37315 | 4.3 | Jun 14 | Nextcloud Server's read-only users can restore old versions Affected: >= 26.0.0, < 26.0.12; >= 27.0.0, < 27.1.7; >= 28.0.0, < 28.0.3 |
| CVE-2022-39330 | 4.3 | Oct 27 | Database resource exhaustion for logged-in users via sharee recommendations with circles Affected: >= 23.0.0, < 23.0.9; >= 24.0.0, < 24.0.5; < 22.2.10 |
| CVE-2026-45266 | 3.5 | Jun 1 | Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling Affected: < 21.1.10; < 22.0.11; < 23.0.3 |
| CVE-2026-45159 | 3.5 | Jun 1 | Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Affected: >= 1.15.0, < 1.15.4; >= 1.16.0, < 1.16.3; >= 1.17.0, < 1.17.1; >= 1.18.0, < 1.18.1 |
| CVE-2024-52514 | 3.5 | Nov 15 | Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control Affected: >= 28.0.0, < 28.0.5; >= 27.0.0, < 27.1.9 |
| CVE-2024-37887 | 3.5 | Jun 14 | Nextcloud Server's events information leaked with shared calendars on recurrence exceptions Affected: >= 27.0.0, < 27.1.10; >= 27.0.0, < 28.0.6; >= 27.0.0, < 29.0.1 |
| CVE-2024-37314 | 3.5 | Jun 14 | Nextcloud Photos' shared albums have no restriction on photo removal Affected: >= 25.0.1, < 25.0.7; >= 26.0.0, < 26.0.2 |
| CVE-2026-45277 | 3.3 | Jun 1 | Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations Affected: < 2.7.2 |
| CVE-2025-66546 | 3.3 | Dec 5 | Nextcloud Calendar app allowed booking appointments without the generated token Affected: >= 6.0.0-rc.1, < 6.0.1; >= 5.0.0-rc.1, < 5.5.6; >= 3.0.0-beta1, < 4.7.19 |
| CVE-2025-66549 | 2.7 | Dec 5 | Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory Affected: < 3.16.5 |
| CVE-2025-66515 | 2.7 | Dec 5 | Nextcloud Approval app allows users to request approval for other users file Affected: >= 2.0.0, < 2.5.0; < 1.3.1 |
| CVE-2022-31120 | 2.7 | Aug 4 | Federated share accepting/declining is not logged in audit log in Nextcloud Server Affected: >= 23.0.0, < 23.0.4; < 22.2.7 |
| CVE-2026-45155 | 2.6 | Jun 1 | Nextcloud: Private circle can be added to another circle via API Affected: >= 32.0.0, < 32.0.7; >= 33.0.0, < 33.0.1 |
| CVE-2026-45154 | 2.6 | Jun 1 | Nextcloud: Improper Access Control in Collectives Affected: >= 2.6.0, < 4.3.0 |