NE
Product
nextcloud/server
189
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 42Medium 125Low 15
Watch
Add nextcloud/server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-49792 | 9.8 | Dec 22 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 23.0.0 before 23.0.12.13; 24.0.0 before 24.0.12.9; 25.0.0 before 25.0.13.4; 26.0.0 before 26.0.9; 26.0.0 before 26.0.9; 27.0.0 before 27.1.4; +1 more |
| CVE-2023-48306 | 9.8 | Nov 21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 22.0.0 before 22.2.10.16; 23.0.0 before 23.0.12.11; 24.0.0 before 24.0.12.7; 25.0.0 before 25.0.11; 25.0.0 before 25.0.11; 26.0.0 before 26.0.6; +3 more |
| CVE-2021-32802 | 9.8 | Sep 7 | Nextcloud server is an open source, self hosted personal cloud Affected: before 20.0.12; 21.0.0 before 21.0.4; 22.0.0 before 22.1.0 |
| CVE-2021-32726 | 9.8 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2021-22915 | 9.8 | Jun 11 | Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations Affected: before 19.0.11; 20.0.0 before 20.0.10; 21.0.0 before 21.0.2 |
| CVE-2023-35172 | 9.1 | Jun 23 | NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform Affected: 21.0.0 before 21.0.9.12; 22.0.0 before 22.2.10.12; 23.0.0 before 23.0.12.7; 24.0.0 before 24.0.12.2; 25.0.0 before 25.0.7; 25.0.0 before 25.0.7; +2 more |
| CVE-2021-32654 | 9.1 | Jun 1 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.11; 20.0.0 before 20.0.10; 21.0.0 before 21.0.2 |
| CVE-2023-45151 | 8.8 | Oct 16 | Nextcloud server is an open source home cloud platform Affected: 25.0.0 before 25.0.8; 25.0.0 before 25.0.8; 26.0.0 before 26.0.3; 26.0.0 before 26.0.3; 27.0.0; 27.0.0 |
| CVE-2023-35928 | 8.8 | Jun 23 | Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform Affected: 19.0.0 before 19.0.13.9; 20.0.0 before 20.0.14.14; 21.0.0 before 21.0.9.12; 22.0.0 before 22.2.10.12; 23.0.0 before 23.0.12.7; 24.0.0 before 24.0.12.2; +4 more |
| CVE-2023-30539 | 8.8 | Apr 17 | Nextcloud is a personal home server system Affected: 21.0.0 before 21.0.9.11; 22.0.0 before 22.2.10.11; 23.0.0 before 23.0.12.6; 24.0.0 before 24.0.11; 24.0.0 before 24.0.11; 25.0.0 before 25.0.5; +1 more |
| CVE-2023-28833 | 8.8 | Mar 30 | Nextcloud server is an open source home cloud implementation Affected: 23.0.0 before 23.0.14; 24.0.0 before 24.0.10; 24.0.0 before 24.0.10; 25.0.0 before 25.0.4; 25.0.0 before 25.0.4 |
| CVE-2023-28643 | 8.8 | Mar 30 | Nextcloud server is an open source home cloud implementation Affected: 24.0.0 before 24.0.9; 24.0.0 before 24.0.9; 25.0.0 before 25.0.3; 25.0.0 before 25.0.3 |
| CVE-2023-26482 | 8.8 | Mar 30 | Nextcloud server is an open source home cloud implementation Affected: 18.0.0 before 20.0.14.12; 21.0.0 before 21.0.9.10; 22.0.0 before 22.2.10.10; 23.0.0 before 23.0.12.5; 24.0.0 before 24.0.10; 24.0.0 before 24.0.10; +2 more |
| CVE-2021-32688 | 8.8 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2021-32679 | 8.8 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2018-3775 | 8.8 | Aug 12 | Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication Affected: before 12.0.3 |
| CVE-2021-32656 | 8.6 | Jun 1 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.11; 20.0.0 before 20.0.10; 21.0.0 before 21.0.2 |
| CVE-2024-52519 | 8.2 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 27.0.0 before 27.1.11.8; 28.0.0 before 28.0.10; 28.0.0 before 28.0.10; 29.0.0 before 29.0.7; 29.0.0 before 29.0.7 |
| CVE-2026-45281 | 8.1 | Jun 1 | Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update Affected: 32.0.0 before 32.0.9; 33.0.0 before 33.0.3; 21.0.0 before 21.0.9.23; 22.0.0 before 22.2.10.39; 23.0.0 before 23.0.12.35; 24.0.0 before 24.0.12.34; +9 more |
| CVE-2024-37882 | 8.1 | Jun 14 | Nextcloud Server is a self hosted personal cloud system Affected: 26.0.0 before 26.0.13; 27.0.0 before 27.1.8; 28.0.0 before 28.0.4; 23.0.0 before 23.0.12.17; 24.0.0 before 24.0.12.13; 25.0.0 before 25.0.13.8; +3 more |
| CVE-2023-35927 | 8.1 | Jun 23 | NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform Affected: 16.0.0 before 19.0.13.9; 20.0.0 before 20.0.14.14; 21.0.0 before 21.0.9.12; 22.0.0 before 22.2.10.12; 23.0.0 before 23.0.12.7; 24.0.0 before 24.0.12.2; +4 more |
| CVE-2023-25817 | 8.1 | Mar 27 | Nextcloud server is an open source, personal cloud implementation Affected: 24.0.0 before 24.0.9 |
| CVE-2021-41177 | 8.1 | Oct 25 | Nextcloud is an open-source, self-hosted productivity platform Affected: before 20.0.13; 21.0.0 before 21.0.5; 22.0.0 before 22.2.0 |
| CVE-2021-32800 | 8.1 | Sep 7 | Nextcloud server is an open source, self hosted personal cloud Affected: before 20.0.12; 21.0.0 before 21.0.4; 22.0.0 before 22.1.0 |
| CVE-2020-8259 | 8.1 | Nov 16 | Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys Affected: before 20.0.0 |
| CVE-2020-8121 | 8.1 | Feb 4 | A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer Affected: before 13.0.9; 14.0.0 before 14.0.5; 14.0.6 before 15.0.0 |
| CVE-2018-16466 | 8.1 | Oct 30 | Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens Affected: before 12.0.11; 13.0.0 before 13.0.6; 14.0.0; 14.0.0; 14.0.0; 14.0.0; +2 more |
| CVE-2018-3761 | 8.1 | Jul 5 | Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint Affected: before 12.0.8; 13.0.0 before 13.0.3 |
| CVE-2016-9463 | 8.1 | Mar 28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass Affected: before 9.0.54; 10.0.0 before 10.0.1 |
| CVE-2019-15613 | 8.0 | Feb 4 | A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes Affected: before 15.0.14; 16.0.0 before 16.0.7; 17.0.0 before 17.0.2 |
| CVE-2023-39963 | 7.8 | Aug 10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 20.0.0 before 20.0.14.15; 21.0.0 before 21.0.9.13; 22.0.0 before 22.2.10.14; 23.0.0 before 23.0.12.9; 24.0.0 before 24.0.12.5; 25.0.0 before 25.0.9; +5 more |
| CVE-2023-25820 | 7.8 | Mar 22 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server… Affected: 21.0.0 before 21.0.9; 22.2.0 before 22.2.10.10; 23.0.0 before 23.0.12.5; 24.0.0 before 24.0.10; 24.0.0 before 24.0.10; 25.0.0 before 25.0.4; +1 more |
| CVE-2023-39962 | 7.7 | Aug 10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 19.0.0 before 19.0.13.10; 20.0.0 before 20.0.14.15; 21.0.0 before 21.0.9.13; 22.0.0 before 22.2.10.14; 23.0.0 before 23.0.12.9; 24.0.0 before 24.0.12.5; +6 more |
| CVE-2020-8154 | 7.7 | May 12 | An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to… Affected: before 17.0.5; 18.0.0 before 18.0.3 |
| CVE-2024-52525 | 7.5 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 28.0.0 before 28.0.12; 28.0.0 before 28.0.12; 29.0.0 before 29.0.9; 29.0.0 before 29.0.9; 30.0.0 before 30.0.2; 30.0.0 before 30.0.2 |
| CVE-2024-37313 | 7.5 | Jun 14 | Nextcloud server is a self hosted personal cloud system Affected: 21.0.0 before 21.0.9.17; 22.0.0 before 22.2.10.22; 23.0.0 before 23.0.12.17; 24.0.0 before 24.0.12.13; 25.0.0 before 25.0.13.8; 26.0.0 before 26.0.13; +5 more |
| CVE-2023-39960 | 7.5 | Oct 13 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 22.0.0 before 22.2.10.14; 23.0.0 before 23.0.12.9; 24.0.0 before 24.0.12.5; 25.0.0 before 25.0.9; 25.0.0 before 25.0.9; 26.0.0 before 26.0.4; +1 more |
| CVE-2023-32320 | 7.5 | Jun 22 | Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform Affected: 21.0.0 before 21.0.9.12; 22.0.0 before 22.2.10.12; 23.0.0 before 23.0.12.7; 24.0.0 before 24.0.12.2; 25.0.0 before 25.0.7; 25.0.0 before 25.0.7; +2 more |
| CVE-2023-28847 | 7.5 | Apr 25 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform Affected: 23.0.0 before 23.0.12.6; 24.0.0 before 24.0.11; 24.0.0 before 24.0.11; 25.0.0 before 25.0.5; 25.0.0 before 25.0.5 |
| CVE-2023-28835 | 7.5 | Mar 30 | Nextcloud server is an open source home cloud implementation Affected: 23.0.0 before 23.0.14; 24.0.0 before 24.0.10; 24.0.0 before 24.0.10; 25.0.0 before 25.0.4; 25.0.0 before 25.0.4 |
| CVE-2023-28644 | 7.5 | Mar 30 | Nextcloud server is an open source home cloud implementation Affected: 25.0.0 before 25.0.3 |
| CVE-2023-25821 | 7.5 | Feb 25 | Nextcloud is an Open Source private cloud software Affected: 24.0.4 before 24.0.7; 24.0.4 before 24.0.7; 25.0.0; 25.0.0 |
| CVE-2023-25579 | 7.5 | Feb 22 | Nextcloud server is a self hosted home cloud product Affected: before 23.0.12; 20.0.0 before 20.0.14; 21.0.0 before 21.0.9; 22.2.0 before 22.2.10; 23.0.0 before 23.0.12; 24.0.0 before 24.0.8; +3 more |
| CVE-2022-36074 | 7.5 | Sep 15 | Nextcloud server is an open source personal cloud product Affected: before 23.0.7; 24.0.0 before 24.0.3 |
| CVE-2021-32705 | 7.5 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2020-8295 | 7.5 | Jan 26 | A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user Affected: before 20.0.0 |
| CVE-2020-8183 | 7.5 | Nov 2 | A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call Affected: before 18.0.6; 19.0.0 before 19.0.1 |
| CVE-2023-48239 | 7.1 | Nov 21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 20.0.0 before 20.0.14.16; 21.0.0 before 21.0.9.13; 22.0.0 before 22.2.10.15; 23.0.0 before 23.0.12.12; 24.0.0 before 24.0.12.8; 25.0.0 before 25.0.13; +5 more |
| CVE-2023-25818 | 7.1 | Mar 27 | Nextcloud server is an open source, personal cloud implementation Affected: 21.0.0 before 21.0.9.10; 22.0.0 before 22.2.10.10; 23.0.0 before 23.0.12.5; 24.0.0 before 24.0.10; 24.0.0 before 24.0.10; 25.0.0 before 25.0.4; +1 more |
| CVE-2026-45810 | 6.8 | Jun 1 | Nextcloud: Propfind requests for file comments allowed to load comments for other files Affected: 31.0.0 before 31.0.12; 32.0.0 before 32.0.3; 21.0.0 before 21.0.9.20; 22.0.0 before 22.2.10.35; 23.0.0 before 23.0.12.31; 24.0.0 before 24.0.12.30; +8 more |