SE
Product
security-advisories
195
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 37Medium 130Low 21
Watch
Add security-advisories to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-52513 | 4.3 | Nov 15 | Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares Affected: >= 28.0.0, < 28.0.11; >= 29.0.0, < 29.0.8; >= 30.0.0, < 30.0.1 |
| CVE-2024-52516 | 4.3 | Nov 15 | Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them Affected: >= 28.0.0, < 28.0.9; >= 29.0.0, < 29.0.5 |
| CVE-2024-37883 | 4.3 | Jun 14 | Nextcloud Deck can access comments and attachments of deleted cards Affected: >= 1.6.0, < 1.6.6; >= 1.7.0, < 1.7.5; >= 1.8.0, < 1.8.7; >= 1.9.0, < 1.9.6; >= 1.10.0, < 1.11.3; >= 1.11.0, < 1.12.1 |
| CVE-2024-37315 | 4.3 | Jun 14 | Nextcloud Server's read-only users can restore old versions Affected: >= 26.0.0, < 26.0.12; >= 27.0.0, < 27.1.7; >= 28.0.0, < 28.0.3 |
| CVE-2024-22401 | 4.3 | Jan 18 | All users can reset the allowed apps list for Nextcloud Guest App users Affected: >= 2.4.0, < 2.4.1; >= 2.5.0, < 2.5.1; >= 3.0.0, < 3.0.1 |
| CVE-2024-22404 | 4.3 | Jan 18 | Permissions bypass in Nextcloud with the files zip app Affected: >= 1.2.0, < 1.2.1; >= 1.3.0, < 1.4.1 |
| CVE-2023-49790 | 4.3 | Dec 22 | App PIN code can be bypassed in Nextcloud Files iOS Affected: < 4.9.2 |
| CVE-2023-48304 | 4.3 | Nov 21 | Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user Affected: >= 25.0.0, < 25.0.11; >= 26.0.0, < 26.0.6; >= 27.0.0, < 27.1.0; >= 22.0.0, < 22.2.10.16; >= 23.0.0, < 23.0.12.11; >= 24.0.0, < 24.0.12.7 |
| CVE-2023-45150 | 4.3 | Oct 16 | Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive Affected: >= 1.0.0, < 4.4.4 |
| CVE-2023-45149 | 4.3 | Oct 16 | Password of talk conversations can be bruteforced in Nextcloud Affected: >= 15.0.0, < 15.0.8; >= 16.0.0, < 16.0.6; >= 17.0.0, < 17.1.1 |
| CVE-2023-45148 | 4.3 | Oct 16 | Rate limiter not working reliable when Memcached is installed in Nextcloud Affected: >= 25.0.0, < 25.0.11; >= 26.0.0, < 26.0.6; >= 27.0.0, < 27.1.0 |
| CVE-2023-45660 | 4.3 | Oct 16 | Require strict cookies for image proxy requests in Nextcloud Mail Affected: >= 2.0.0, < 2.2.8; >= 3.0.0, < 3.3.0 |
| CVE-2023-39961 | 4.3 | Aug 10 | Text does not respect "Allow download" permissions Affected: >= 24.0.4, < 24.0.12.5; >= 25.0.0, < 25.0.9; >= 27.0.0, < 27.0.1; >= 26.0.0, < 26.0.4 |
| CVE-2023-33183 | 4.3 | May 30 | Error in calendar when booking an appointment reveals the full path of the website Affected: < 3.5.5; < 4.2.3 |
| CVE-2023-33182 | 4.3 | May 30 | Nextcloud Contacts photos only sanitized if mime type is all lower case Affected: >= 4.1.0, < 4.2.4; >= 5.0.0, < 5.0.3 |
| CVE-2023-30540 | 4.3 | Apr 17 | Chat poll data can still be queried from API after purging history in Nextcloud talk Affected: >= 15.0.0, < 15.0.5 |
| CVE-2023-28834 | 4.3 | Apr 3 | Full path of data directory exposed to Nextcloud server users Affected: >= 23.0.0, < 23.0.14; >= 24.0.0, < 24.0.10; >= 25.0.0, < 25.0.4 |
| CVE-2023-26041 | 4.3 | Feb 27 | Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured Affected: < 15.0.3 |
| CVE-2023-23943 | 4.3 | Feb 6 | Blind SSRF via server URL input in the Nextcloud Mail app Affected: >= 2.0.0, < 2.2.2; < 1.15.0 |
| CVE-2023-22471 | 4.3 | Jan 14 | Nextcloud Deck vulnerable to authorization bypass Affected: >= 1.60, < 1.6.5; >= 1.7.0, < 1.7.3; >= 1.8.0, < 1.8.2 |
| CVE-2022-39339 | 4.3 | Nov 25 | Cleartext Transmission of Sensitive Information in user_oidc Affected: < 1.2.1 |
| CVE-2022-39330 | 4.3 | Oct 27 | Database resource exhaustion for logged-in users via sharee recommendations with circles Affected: >= 23.0.0, < 23.0.9; >= 24.0.0, < 24.0.5; < 22.2.10 |
| CVE-2022-36075 | 4.3 | Sep 15 | File list exposure in Nextcloud Files Access Control Affected: < 1.12.2; >= 1.13.0, < 1.13.1; >= 1.14.0, < 1.14.1 |
| CVE-2022-31131 | 4.3 | Jul 6 | Ownership check missing when updating or deleting mail attachments in Nextcloud mail Affected: < 1.12.2 |
| CVE-2024-22403 | 3.7 | Jan 18 | OAuth2 authorization codes are valid indefinetly in Nextcloud server Affected: < 28.0.0 |
| CVE-2026-45266 | 3.5 | Jun 1 | Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling Affected: < 21.1.10; < 22.0.11; < 23.0.3 |
| CVE-2026-45159 | 3.5 | Jun 1 | Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner Affected: >= 1.15.0, < 1.15.4; >= 1.16.0, < 1.16.3; >= 1.17.0, < 1.17.1; >= 1.18.0, < 1.18.1 |
| CVE-2024-52514 | 3.5 | Nov 15 | Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control Affected: >= 28.0.0, < 28.0.5; >= 27.0.0, < 27.1.9 |
| CVE-2024-37887 | 3.5 | Jun 14 | Nextcloud Server's events information leaked with shared calendars on recurrence exceptions Affected: >= 27.0.0, < 27.1.10; >= 27.0.0, < 28.0.6; >= 27.0.0, < 29.0.1 |
| CVE-2024-37314 | 3.5 | Jun 14 | Nextcloud Photos' shared albums have no restriction on photo removal Affected: >= 25.0.1, < 25.0.7; >= 26.0.0, < 26.0.2 |
| CVE-2023-28845 | 3.5 | Mar 31 | Chat room membership disclosed via autocompletion in Nextcloud talk Affected: >= 15.0.0, < 15.0.4; >= 14.0.0, < 14.0.9 |
| CVE-2023-22469 | 3.5 | Jan 10 | Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache Affected: < 1.8.2 |
| CVE-2022-31014 | 3.5 | Jul 5 | SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server Affected: < 22.2.8; >= 23.0.0, < 23.0.5; >= 24.0.0, < 24.0.1 |
| CVE-2026-45277 | 3.3 | Jun 1 | Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations Affected: < 2.7.2 |
| CVE-2025-66546 | 3.3 | Dec 5 | Nextcloud Calendar app allowed booking appointments without the generated token Affected: >= 6.0.0-rc.1, < 6.0.1; >= 5.0.0-rc.1, < 5.5.6; >= 3.0.0-beta1, < 4.7.19 |
| CVE-2025-66549 | 2.7 | Dec 5 | Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory Affected: < 3.16.5 |
| CVE-2025-66515 | 2.7 | Dec 5 | Nextcloud Approval app allows users to request approval for other users file Affected: >= 2.0.0, < 2.5.0; < 1.3.1 |
| CVE-2023-48303 | 2.7 | Nov 21 | Nextcloud Server admins can change authentication details of user configured external storage Affected: >= 25.0.0, < 25.0.11; >= 26.0.0, < 26.0.6; >= 27.0.0, < 27.1.0 |
| CVE-2022-41969 | 2.7 | Dec 1 | Nextcloud Server has no password length limit when creating a user as an administrator Affected: < 23.0.11; >= 24.0.0, < 24.0.7 |
| CVE-2022-35931 | 2.7 | Sep 6 | Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator Affected: >= 24.0.0, < 24.0.3; < 22.2.10; >= 23.0.0, < 23.0.7 |
| CVE-2022-31120 | 2.7 | Aug 4 | Federated share accepting/declining is not logged in audit log in Nextcloud Server Affected: >= 23.0.0, < 23.0.4; < 22.2.7 |
| CVE-2026-45155 | 2.6 | Jun 1 | Nextcloud: Private circle can be added to another circle via API Affected: >= 32.0.0, < 32.0.7; >= 33.0.0, < 33.0.1 |
| CVE-2026-45154 | 2.6 | Jun 1 | Nextcloud: Improper Access Control in Collectives Affected: >= 2.6.0, < 4.3.0 |
| CVE-2023-28646 | 2.4 | Mar 30 | App lockout in nextcloud Android app can be bypassed via thirdparty apps Affected: >= 3.7.0, < 3.24.1 |
| CVE-2023-22473 | 2.1 | Jan 9 | Passcode bypass on Talk-Android app Affected: < 15.0.2 |