SE
Product
security-advisories
214
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 37Medium 144Low 25
Watch
Add security-advisories to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-39210 | 5.5 | Sep 16 | Access to internal files of the Nextcloud Android app Affected: < 3.21.0 |
| CVE-2025-66554 | 5.4 | Dec 5 | Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field Affected: >= 7.0.0-alpha.1, < 7.2.5; >= 6.0.0-alpha1, < 6.0.6; < 5.5.4 |
| CVE-2025-66514 | 5.4 | Dec 5 | Nextcloud Mail stored HTML injection in subject text Affected: >= 5.2.0-beta.1, < 5.5.3 |
| CVE-2024-52518 | 5.4 | Nov 15 | Nextcloud Server is missing password confirmation when changing external storage options Affected: >= 28.0.0, < 28.0.12; >= 29.0.0, < 29.0.9; >= 30.0.0, < 30.0.2 |
| CVE-2024-37884 | 5.4 | Jun 14 | Nextcloud Server's users can delete old versions of read-only shared files Affected: >= 26.0.0, < 26.0.13; >= 27.0.0, < 27.1.8; >= 28.0.0, < 28.0.4 |
| CVE-2024-22402 | 5.4 | Jan 18 | Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist Affected: >= 2.4.0, < 2.4.1; >= 2.5.0, < 2.5.1; >= 3.0.0, < 3.0.1 |
| CVE-2024-22213 | 5.4 | Jan 18 | Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app Affected: >= 1.9.0, < 1.9.5; >= 1.10.0, < 1.11.2 |
| CVE-2023-49791 | 5.4 | Dec 22 | Workflows do not require password confirmation on API level Affected: >= 23.0.0, < 23.0.12.13; >= 24.0.0, < 24.0.12.9; >= 25.0.0, < 25.0.13.4; >= 26.0.0, < 26.0.9; >= 27.0.0, < 27.1.4 |
| CVE-2023-48302 | 5.4 | Nov 21 | Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V Affected: >= 25.0.0, < 25.0.13; >= 26.0.0, < 26.0.8; >= 27.0.0, < 27.1.3 |
| CVE-2023-48301 | 5.4 | Nov 21 | Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name Affected: >= 25.0.0, < 25.0.13; >= 26.0.0, < 26.0.8; >= 27.0.0, < 27.1.3 |
| CVE-2023-28848 | 5.4 | Apr 4 | CSRF protection on user_oidc login returned the expected token in case of an error Affected: >= 1.0.0, < 1.3.0 |
| CVE-2022-39338 | 5.4 | Nov 25 | Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc Affected: < 1.2.1 |
| CVE-2022-39332 | 5.4 | Nov 25 | Cross-site scripting (XSS) in Nextcloud Desktop Client Affected: < 3.6.1 |
| CVE-2022-39331 | 5.4 | Nov 25 | Cross-site Scripting (XSS) in Nexcloud Desktop Client Affected: < 3.6.1 |
| CVE-2026-45543 | 5.3 | Jun 1 | Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share Affected: >= 4.3.0, < 5.2.7 |
| CVE-2025-66513 | 5.3 | Dec 5 | Nextcloud Tables app share information not limited to relevant users Affected: >= 1.0.0-beta.1, < 1.0.1; >= 0.9.0-beta.1, < 0.9.6; < 0.8.9 |
| CVE-2025-47791 | 5.3 | May 16 | Nextcloud Server's test remote endpoint is not rate limited Affected: >= 28.0.0, < 28.0.13; >= 29.0.0, < 29.0.10; >= 30.0.0, < 30.0.3 |
| CVE-2024-52521 | 5.3 | Nov 15 | Nextcloud Server has a potential hash collision for background jobs could skip queuing them Affected: >= 28.0.0, < 28.0.10; >= 29.0.0, < 29.0.7 |
| CVE-2023-39959 | 5.3 | Aug 10 | Existence of calendars and address books can be checked by unauthenticated users Affected: >= 25.0.0, < 25.0.9; >= 26.0.0, < 26.0.4; >= 27.0.0, < 27.0.1 |
| CVE-2023-39958 | 5.3 | Aug 10 | Missing brute force protection on password reset token OAuth2 API controller Affected: >= 22.0.0, < 22.2.10.13; >= 23.0.0, < 23.0.12.8; >= 24.0.0, < 24.0.12.5; >= 25.0.0, < 25.0.9; >= 26.0.0, < 26.0.4; >= 27.0.0, < 27.0.1 |
| CVE-2023-33184 | 5.3 | May 27 | Blind SSRF in the Nextcloud Mail app on avatar endpoint Affected: < 1.15.3; < 2.2.5; < 3.02 |
| CVE-2023-25162 | 5.3 | Feb 13 | Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs Affected: < 23.0.12; >= 24.0.0, < 24.0.8 |
| CVE-2023-25161 | 5.3 | Feb 13 | Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails Affected: = 25.0.0; >= 24.0.0, < 24.0.8; < 23.0.2 |
| CVE-2023-25160 | 5.3 | Feb 13 | IDOR Vulnerability in Nextcloud Mail Affected: < 1.11.8; >= 1.12.0, < 1.12.9; >= 1.13.0, < 1.14.5; >= 2.0.0, < 2.2.1 |
| CVE-2023-25159 | 5.3 | Feb 13 | Nextcloud Server previews are accessible without a watermark Affected: >= 24.0.4, < 24.0.8; = 25.0.0; >= 6.0.0, < 6.3.1; = 7.0.0 |
| CVE-2022-41970 | 5.3 | Dec 1 | Nextcloud Server's disabled download shares still allow download through preview images Affected: < 24.0.7; >= 25.0.0, < 25.0.1 |
| CVE-2022-41968 | 5.3 | Dec 1 | Nextcloud Server's calendar name length not validated before writing to database Affected: < 23.0.10; >= 24.0.0, < 24.0.5 |
| CVE-2022-39329 | 5.3 | Oct 27 | Profile of disabled user stays accessible Affected: < 23.0.9; >= 24.0.0, < 24.0.5 |
| CVE-2022-39212 | 5.3 | Sep 16 | Last video frame is still sent after video is disabled in a call in Nextcloud Talk Affected: < 13.0.8; >= 14.0.0, < 14.0.4 |
| CVE-2022-39211 | 5.3 | Sep 16 | Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server Affected: < 23.0.8; >= 24.0.0, < 24.0.4 |
| CVE-2022-35932 | 5.3 | Aug 12 | Missing rate limit when trying to join a password protected Nextcloud Talk conversation Affected: >= 12.2.0, < 12.2.7; >= 13.0.0, < 13.0.7; >= 14.0.0, < 14.0.3 |
| CVE-2022-31118 | 5.3 | Aug 4 | Missing brute force protection on cloud federation sharing in Nextcloud Server Affected: < 22.2.9; >= 23.0.0, < 23.0.6; >= 24.0.0, < 24.0.2 |
| CVE-2021-41233 | 5.3 | Mar 10 | Missing authorization in Nextcloud text Affected: < 20.0.14; >= 21.0.0, < 21.0.6; >= 22.0.0, < 22.2.1 |
| CVE-2021-41239 | 5.3 | Mar 8 | User enumeration setting not respected in Nextcloud server Affected: < 20.0.14; >= 21.0.0, < 21.0.6; >= 22.2.0, < 22.2.1 |
| CVE-2025-66510 | 4.9 | Dec 5 | Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list Affected: >= 32.0.0beta1, < 32.0.1; < 31.0.10 |
| CVE-2022-31119 | 4.9 | Aug 4 | Password disclosure in log file in Nextcloud Mail App Affected: < 1.12.1 |
| CVE-2023-39953 | 4.8 | Aug 10 | Issuer not verified from obtained token in user_oidc Affected: >= 1.0.0, < 1.3.3 |
| CVE-2024-37886 | 4.7 | Jun 14 | Nextcloud user_oidc's ID4me does not validate signature or expiration Affected: < 1.3.5 |
| CVE-2022-39334 | 4.7 | Nov 25 | nextcloudcmd incorrectly trusts bad TLS certificates Affected: < 3.6.1 |
| CVE-2026-45153 | 4.6 | Jun 1 | Nextcloud: PIN bypass in PassCodeActivity via back button Affected: >= 33.0.0, < 33.1.0 |
| CVE-2024-37317 | 4.6 | Jun 14 | Nextcloud Notes app can be tricked into using a received share created before the user logged in Affected: >= 4.6.0, < 4.9.3 |
| CVE-2024-37316 | 4.6 | Jun 14 | Nextcloud Calendar's event create can create attachments that link to other websites Affected: >= 4.3.0, < 4.6.8; >= 4.7.0, < 4.7.2 |
| CVE-2023-48305 | 4.4 | Nov 21 | Nextcloud Server user_ldap app logs user passwords in the log file on level debug Affected: >= 25.0.0, < 25.0.11; >= 26.0.0, < 26.0.6; >= 27.0.0, < 27.1.0 |
| CVE-2026-45544 | 4.3 | Jun 1 | Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService Affected: >= 0.8.0, < 1.0.4 |
| CVE-2026-45286 | 4.3 | Jun 1 | Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint Affected: >= 5.5.13, < 5.5.17; >= 6.2.0, < 6.2.3 |
| CVE-2026-45283 | 4.3 | Jun 1 | Nextcloud: Files Lock app allows users to lock and unlock files of other users Affected: >= 32.0.0, < 32.0.2; >= 33.0.0, < 33.0.1 |
| CVE-2026-45264 | 4.3 | Jun 1 | Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames Affected: >= 17.0.0, < 17.0.15; >= 18.0.0, < 18.1.12; >= 19.0.0, < 19.1.16; >= 20.0.0, < 20.1.11; >= 21.0.0, < 21.0.4 |
| CVE-2025-66558 | 4.3 | Dec 5 | Nextcloud Twofactor WebAuthn app was updated based on public key Affected: < 1.4.2; >= 2.0.0-beta.1, < 2.4.1 |
| CVE-2025-66556 | 4.3 | Dec 5 | Nextcloud talk allows participants to blindly delete poll drafts of other users by ID Affected: < 20.1.8; >= 21.0.0-beta.1, < 21.1.2 |
| CVE-2025-66545 | 4.3 | Dec 5 | Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin Affected: < 14.0.11; >= 15.0.0-beta1, < 15.3.12; >= 16.0.0, < 16.0.15; >= 17.0.0-beta.1, < 17.0.14; >= 18.0.0-beta.1, < 18.1.8; >= 19.0.0-alpha.1, < 19.1.8; +1 more |