nextcloud

Records402All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical19CVSS 9.0–10.0

CVSS high73CVSS 7.0–8.9

Exploited now

nextcloud records in CISA KEV

No nextcloud vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Nextcloud Server 189 records HIGH Nextcloud 28 records MEDIUM Desktop 27 records MEDIUM Talk 20 records MEDIUM Deck 17 records MEDIUM Mail 15 records MEDIUM Calendar 10 records HIGH User Oidc 9 records MEDIUM

Records

189 records in Nextcloud Server · all components

TI-2023-20855 CVE-2023-39962

Users can delete external storage mount points

HIGH 67

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01023 Published 2023-08-10 Fixed in 19.0.13.10, 20.0.14.15 +7 CWE-284

TI-2023-11091 CVE-2023-25821

Nextcloud download permissions can be changed by resharer

HIGH 66

Nextcloud is an Open Source private cloud software.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00946 Published 2023-02-24 Fixed in 24.0.7, 25.0.1 CWE-284

TI-2023-10624 CVE-2023-25162

Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs

MEDIUM 63

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00816 Published 2023-02-13 Fixed in 23.0.12, 24.0.8 CWE-918

TI-2025-37238 CVE-2025-59788 · GHSA-88cv-g9gq-h6pq

Cross-site scripting in Nextcloud

MEDIUM 62

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 3…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00324 Published 2025-12-04 Fixed in 22.2.10.33, 23.0.12.29 +9 CWE-749

TI-2023-11086 CVE-2023-25816

nextcloud vulnerable to Uncontrolled Resource Consumption

MEDIUM 62

Nextcloud is an Open Source private cloud software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01373 Published 2023-02-24 Fixed in 25.0.3 CWE-400

TI-2022-18738 CVE-2022-39364

Exception logging in Sharepoint app reveals clear-text connection details

MEDIUM 62

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00575 Published 2022-10-27 Fixed in 22.2.10.5, 23.0.9 +1 CWE-312

TI-2022-08555 CVE-2022-24741

High memory usage in Nextcloud server

MEDIUM 62

Nextcloud server is an open source, self hosted cloud style services platform.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01606 Published 2022-03-09 Fixed in 21.0.8, 22.2.4 +1 CWE-400

TI-2023-27198 CVE-2023-49791

Workflows do not require password confirmation on API level

MEDIUM 58

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00608 Published 2023-12-22 Fixed in 23.0.12.13, 24.0.12.9 +3 CWE-284

TI-2023-26164 CVE-2023-48301

Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name

MEDIUM 58

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0064 Published 2023-11-21 Fixed in 25.0.13, 26.0.8 +1 CWE-79

TI-2022-13059 CVE-2022-31014

SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server

MEDIUM 58

Nextcloud server is an open source personal cloud server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02515 Published 2022-07-05 Fixed in 22.2.8, 23.0.5 +1 CWE-74

TI-2022-08699 CVE-2022-24889

Insufficient Verification of Data Authenticity in Nextcloud Server

MEDIUM 53

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00656 Published 2022-04-27 Fixed in 21.0.8, 22.2.4 +1 CWE-345

TI-2023-27199 CVE-2023-49792

Bruteforce protection can be bypassed with misconfigured proxy

MEDIUM 50

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01041 Published 2023-12-22 Fixed in 23.0.12.13, 24.0.12.9 +3 CWE-307

TI-2023-11629 CVE-2023-26482

Scope of workflow operations is not validated in nextcloud server

MEDIUM 48

Nextcloud server is an open source home cloud implementation.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.04176 Published 2023-03-30 Fixed in 24.0.10, 25.0.4 CWE-78

TI-2021-12467 CVE-2021-32802

Preview generation used third-party library not suited for user-generated content in Nextcloud server

MEDIUM 47

Nextcloud server is an open source, self hosted personal cloud.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02604 Published 2021-09-07 Fixed in 20.0.12, 21.0.4 +1 CWE-829

TI-2021-12394 CVE-2021-32726

Webauthn tokens not removed after user has been deleted

MEDIUM 46

Nextcloud Server is a Nextcloud package that handles data storage.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01779 Published 2021-07-12 Fixed in 19.0.13, 20.0.11 +1 CWE-708

TI-2021-05776 CVE-2021-22915

Missing brute-force protection in Nextcloud Server

MEDIUM 46

Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01739 Published 2021-06-11 No fix listed CWE-307

TI-2023-26169 CVE-2023-48306

Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF

MEDIUM 43

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00797 Published 2023-11-21 Fixed in 22.2.10.16, 23.0.12.11 +4 CWE-918

TI-2023-17617 CVE-2023-35172

Nextcloud Server password reset endpoint is not brute force protected

MEDIUM 43

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00918 Published 2023-06-23 No fix listed CWE-307

TI-2021-12322 CVE-2021-32654

Attacker can obtain write access to any federated share/public link

MEDIUM 43

Nextcloud Server is a Nextcloud package that handles data storage.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01849 Published 2021-06-01 Fixed in 19.0.11, 20.0.10 +1 CWE-639

TI-2023-17990 CVE-2023-35928

Nextcloud user scoped external storage can be used to gather credentials of other users

MEDIUM 42

Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00981 Published 2023-06-23 No fix listed CWE-274

TI-2021-12356 CVE-2021-32688

Application specific tokens can change their own scope

MEDIUM 42

Nextcloud Server is a Nextcloud package that handles data storage.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02309 Published 2021-07-12 Fixed in 19.0.13, 20.0.11 +1 CWE-285

TI-2016-07734 CVE-2016-9463 · GHSA-4r4x-7f2r-2f4c

Improper authentication in Nextcloud Server & ownCloud Server Nextcloud Server before…

MEDIUM 42

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.04095 Published 2017-03-28 No fix listed CWE-303

TI-2023-24172 CVE-2023-45151

OAuth2 client_secret stored in plain text in the Nextcloud database

MEDIUM 41

Nextcloud server is an open source home cloud platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00611 Published 2023-10-16 Fixed in 25.0.8, 26.0.3 +1 CWE-312

TI-2023-15614 CVE-2023-32320

Nextcloud Server's brute force protection allows someone to send more requests than intended

MEDIUM 41

Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00872 Published 2023-06-22 No fix listed CWE-307

TI-2021-12347 CVE-2021-32679

Filenames not escaped by default in controllers using DownloadResponse

MEDIUM 41

Nextcloud Server is a Nextcloud package that handles data storage.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0137 Published 2021-07-12 Fixed in 19.0.13, 20.0.11 +1 CWE-116

Open these records in search →