Login Request a demo
SE
Product
security-advisories
by nextcloud · last CVE Jun 1, 2026
87
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities87In the news0Timeline
Severity mix
Critical 1High 12Medium 62Low 12
Severity
All severities87Critical1High12Medium62Low12
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add security-advisories to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-45284
8.8
0%
Jun 1
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
Affected: >= 1.3.6, < 8.4.0
CVE-2026-45545
8.2
0%
Jun 1
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
Affected: >= 0.7.0, < 0.7.7; >= 0.8.0, < 0.8.10; >= 0.9.0, < 0.9.8; >= 1.0.0, < 1.0.4
CVE-2024-52519
8.2
1%
Nov 15
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
Affected: >= 28.0.0, < 28.0.10; >= 29.0.0, < 29.0.7
CVE-2026-45281
8.1
0%
Jun 1
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
Affected: >= 32.0.0, < 32.0.9; >= 33.0.0, < 33.0.3
CVE-2026-45156
8.1
0%
Jun 1
Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
Affected: >= 0.3.0, < 3.1.0; >= 5.0.0, < 5.1.0; >= 6.0.0, < 6.4.0
CVE-2024-52508
8.1
1%
Nov 15
Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers
Affected: >= 1.9.0, < 1.14.6; >= 2.1.0, < 2.2.11; >= 3.1.0, < 3.6.3; >= 1.15.0, < 1.15.4; >= 3.7.0, < 3.7.7
CVE-2024-37882
8.1
1%
Jun 14
Nextcloud Server can reshare read&share only folder with more permissions
Affected: >= 26.0.0, < 26.0.13; >= 27.0.0, < 27.1.8; >= 28.0.0, < 28.0.4
CVE-2024-37885
7.8
0%
Jun 14
Code injection in Nextcloud Desktop Client for macOS
Affected: < 3.12.0
CVE-2024-52510
7.5
1%
Nov 15
Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
Affected: >= 3.0.0, < 3.14.2
CVE-2024-52525
7.5
0%
Nov 15
Nextcloud Server User password is available in memory of the PHP process
Affected: >= 28.0.0, < 28.0.12; >= 29.0.0, < 29.0.9; >= 30.0.0, < 30.0.2
CVE-2024-37313
7.5
0%
Jun 14
Nextcloud server allows the by-pass the second factor
Affected: >= 26.0.0, < 26.0.13; >= 27.0.0, < 27.1.8; >= 28.0.0, < 28.0.4
CVE-2026-45722
7.1
0%
Jun 1
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
Affected: >= 0.9.0, < 0.9.7; >= 1.0.0, < 1.0.2
Showing 12