Read the docs

nextcloud

Records402All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical19CVSS 9.0–10.0
CVSS high73CVSS 7.0–8.9

Exploited now

nextcloud records in CISA KEV

No nextcloud vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nextcloud Server 189 records HIGH Nextcloud 28 records MEDIUM Desktop 27 records MEDIUM Talk 20 records MEDIUM Deck 17 records MEDIUM Mail 15 records MEDIUM Calendar 10 records HIGH User Oidc 9 records MEDIUM

Records

402 records

TI-2026-18211 CVE-2026-22683 · GHSA-9q9g-rp9x-244h

Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Priority HIGH 73

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02609 Published 2026-04-07 Fixed in 1.615.0 CWE-862
TI-2023-20855 CVE-2023-39962

Users can delete external storage mount points

Priority HIGH 67

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01023 Published 2023-08-10 Fixed in 19.0.13.10, 20.0.14.15 +7 CWE-284
TI-2026-53897 CVE-2026-77165 · GHSA-77h3-rj6p-8wj8

Improper access control in nextcloud Server

Priority MEDIUM 62

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-21 No fix listed CWE-284
TI-2025-37238 CVE-2025-59788 · GHSA-88cv-g9gq-h6pq

Cross-site scripting in Nextcloud

Priority MEDIUM 62

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 3…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00324 Published 2025-12-04 Fixed in 22.2.10.33, 23.0.12.29 +9 CWE-749
TI-2022-08555 CVE-2022-24741

High memory usage in Nextcloud server

Priority MEDIUM 62

Nextcloud server is an open source, self hosted cloud style services platform.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01606 Published 2022-03-09 Fixed in 21.0.8, 22.2.4 +1 CWE-400
TI-2022-08697 CVE-2022-24887

Open Redirect in Nextcloud Talk

Priority MEDIUM 60

Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00938 Published 2022-04-27 Fixed in 11.3.4, 12.2.2 +1 CWE-601
TI-2022-18710 CVE-2022-39334

nextcloudcmd incorrectly trusts bad TLS certificates

Priority MEDIUM 55

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00203 Published 2022-11-25 Fixed in 3.6.1 CWE-295
TI-2024-19993 CVE-2024-30247

Command Injection as root in NextCloudPi web panel

Priority MEDIUM 53

NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02122 Published 2024-03-29 Fixed in 1.53.1 CWE-78
Load more
Open these records in search →