nextcloud

Records402All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical19CVSS 9.0–10.0

CVSS high73CVSS 7.0–8.9

Exploited now

nextcloud records in CISA KEV

No nextcloud vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Nextcloud Server 189 records HIGH Nextcloud 28 records MEDIUM Desktop 27 records MEDIUM Talk 20 records MEDIUM Deck 17 records MEDIUM Mail 15 records MEDIUM Calendar 10 records HIGH User Oidc 9 records MEDIUM

Records

10 records in Calendar · all components

TI-2022-08650 CVE-2022-24838

Command Injection in Appointment Emails for Nextcloud Calendar

HIGH 73

Nextcloud Calendar is a calendar application for the nextcloud framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3302 Published 2022-04-11 Fixed in 3.2.2 CWE-74

TI-2023-24171 CVE-2023-45150

Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive

MEDIUM 53

Nextcloud calendar is a calendar app for the Nextcloud server platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00477 Published 2023-10-16 Fixed in 4.4.4 CWE-400

TI-2023-26171 CVE-2023-48308

Calendar app returns full stacktrace when an error happens while editing appointment

LOW 30

Nextcloud/Cloud is a calendar app for Nextcloud.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00547 Published 2023-12-21 Fixed in 4.5.3 CWE-1258

TI-2025-40933 CVE-2025-66511

Nextcloud Calendar app used predictable proposal participant tokens

LOW 29

Nextcloud Calendar is a calendar app for Nextcloud.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00316 Published 2025-12-05 Fixed in 6.0.3 CWE-330

TI-2025-40961 CVE-2025-66550

Nextcloud Calendar attachments of local files are offered to downloaded

LOW 26

Nextcloud Calendar is a calendar app for Nextcloud.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00366 Published 2025-12-05 Fixed in 5.2.4, 4.7.17 CWE-241

TI-2018-02759 CVE-2018-3763 · GHSA-5pqm-hfmj-g8jg

Cross-site scripting in Nextcloud Calendar application

LOW 23

In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00614 Published 2018-07-05 No fix listed CWE-79

TI-2024-24828 CVE-2024-37316

Nextcloud Calendar's event create can create attachments that link to other websites

LOW 21

Nextcloud Calendar is a calendar app for Nextcloud.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00362 Published 2024-06-14 Fixed in 4.6.8, 4.7.2 CWE-241

TI-2026-33086 CVE-2026-45286

Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint

LOW 20

Nextcloud is an open source content collaboration platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00281 Published 2026-06-01 Fixed in 5.5.17, 6.2.3 CWE-200

TI-2023-16360 CVE-2023-33183

Error in calendar when booking an appointment reveals the full path of the website

LOW 20

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00438 Published 2023-05-30 Fixed in 3.5.5, 4.2.3 CWE-285

TI-2025-40957 CVE-2025-66546

Nextcloud Calendar app allowed booking appointments without the generated token

LOW 15

Nextcloud Calendar is a calendar app for Nextcloud.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00149 Published 2025-12-05 Fixed in 6.0.1, 5.5.6 +1 CWE-639

Open these records in search →