Vulnerabilities

TI-2026-33545 CVE-2026-45810

Nextcloud: Propfind requests for file comments allowed to load comments for other files

LOW 30

Nextcloud is an open source content collaboration platform.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00252 Published 2026-06-01 Fixed in 31.0.12, 32.0.3 CWE-639

TI-2026-33433 CVE-2026-45691

Nextcloud: Bypass of second factor authentication on DAV endpoints

LOW 26

Nextcloud is an open source content collaboration platform.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.0029 Published 2026-06-01 Fixed in 32.0.9, 33.0.3 CWE-287

TI-2026-33432 CVE-2026-45690

Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay

LOW 26

Nextcloud is an open source content collaboration platform.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.0029 Published 2026-06-01 Fixed in 32.0.9, 33.0.3 CWE-287

TI-2026-33085 CVE-2026-45285

Nextcloud: Hidden Public Link creation when sharing to a Team External Member

LOW 30

Nextcloud is an open source content collaboration platform.

CVSS 3.1MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00293 Published 2026-06-01 Fixed in 32.0.9, 33.0.3 CWE-862

TI-2026-33083 CVE-2026-45283

Nextcloud: Files Lock app allows users to lock and unlock files of other users

LOW 27

Nextcloud is an open source content collaboration platform.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00211 Published 2026-06-01 Fixed in 32.0.2, 33.0.1 CWE-287

TI-2026-33082 CVE-2026-45282

Improper access control in nextcloud security-advisories

LOW 29

Nextcloud is an open source content collaboration platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00294 Published 2026-06-01 Fixed in 32.0.9, 33.0.3 CWE-284

TI-2026-33081 CVE-2026-45281

Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update

LOW 37

Nextcloud is an open source content collaboration platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00284 Published 2026-06-01 Fixed in 32.0.9, 33.0.3 CWE-639

TI-2026-33080 CVE-2026-45279

Nextcloud: Limited path traversal via template API if using `{lang}` in config

LOW 29

Nextcloud is an open source content collaboration platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00392 Published 2026-06-01 Fixed in 31.0.14, 32.0.4 CWE-22

TI-2025-39508 CVE-2025-64011 · GHSA-h6j9-6xjq-44c4

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in…

LOW 20

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00324 Published 2025-12-12 No fix listed CWE-639

TI-2025-40963 CVE-2025-66552

Nextcloud Server admin_audit does not log all actions on files in groupfolders

LOW 20

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00333 Published 2025-12-05 Fixed in 32.0.1, 31.0.9 CWE-778

TI-2025-40958 CVE-2025-66547

Nextcloud Server users can modify tags on files that do not belong to them

LOW 20

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00299 Published 2025-12-05 Fixed in 31.0.1 CWE-639

TI-2025-40934 CVE-2025-66512

Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud

LOW 27

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00301 Published 2025-12-05 Fixed in 32.0.3, 31.0.12 CWE-80

TI-2025-40932 CVE-2025-66510

Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list

LOW 23

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00384 Published 2025-12-05 Fixed in 32.0.1, 31.0.10 CWE-359

TI-2025-37238 CVE-2025-59788 · GHSA-88cv-g9gq-h6pq

Cross-site scripting in Nextcloud

MEDIUM 62

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 3…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00324 Published 2025-12-04 Fixed in 22.2.10.33, 23.0.12.29 +9 CWE-749

TI-2025-30259 CVE-2025-47794

Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission

LOW 21

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00495 Published 2025-05-16 Fixed in 26.0.13.13, 27.1.11.13 +4 CWE-284

TI-2025-30258 CVE-2025-47793

Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file

LOW 30

Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00821 Published 2025-05-16 Fixed in 30.0.2, 29.0.9 +4 CWE-770

TI-2025-30256 CVE-2025-47791

Nextcloud Server's test remote endpoint is not rate limited

LOW 24

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0038 Published 2025-05-16 Fixed in 28.0.13, 29.0.10 +1 CWE-918

TI-2025-30255 CVE-2025-47790

Nextcloud Server doesn't request second factor after session timeout

LOW 31

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00393 Published 2025-05-16 Fixed in 26.0.13.15, 27.1.11.15 +4 CWE-287

TI-2024-35184 CVE-2024-52513

Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares

LOW 21

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00558 Published 2024-11-15 Fixed in 28.0.11, 29.0.8 +1 CWE-200

TI-2024-35185 CVE-2024-52514

Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control

LOW 20

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 4.1 Network Low privileges User interaction EPSS 0.00513 Published 2024-11-15 Fixed in 28.0.5, 27.1.9 CWE-284

TI-2024-35186 CVE-2024-52515

Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews

LOW 30

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.007 Published 2024-11-15 Fixed in 29.0.1, 28.0.6 +1 CWE-706

TI-2024-35187 CVE-2024-52516

Improper privilege management in nextcloud security-advisories

LOW 20

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00456 Published 2024-11-15 Fixed in 28.0.9, 29.0.5 CWE-269

TI-2024-35188 CVE-2024-52517

Nextcloud Server's global credentials of external storages are sent back to the frontend

LOW 27

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00633 Published 2024-11-15 Fixed in 28.0.11, 29.0.8 +1 CWE-200

TI-2024-35189 CVE-2024-52518

Nextcloud Server is missing password confirmation when changing external storage options

LOW 25

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00537 Published 2024-11-15 Fixed in 28.0.12, 29.0.9 +1 CWE-287

TI-2024-35190 CVE-2024-52519

Nextcloud Server's OAuth2 client secrets were stored in a recoverable way

LOW 36

Nextcloud Server is a self hosted personal cloud system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00528 Published 2024-11-15 Fixed in 28.0.10, 29.0.7 CWE-922

Vulnerabilities

Filters