NE
Product
nextcloud/server
189
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 42Medium 125Low 15
Watch
Add nextcloud/server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-0893 | 5.4 | May 8 | Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability… Affected: before 9.0.58; 10.0.0 before 10.0.5; 11.0.0 before 11.0.3 |
| CVE-2017-0891 | 5.4 | May 8 | Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components Affected: before 9.0.58; 10.0.0 before 10.0.5; 11.0.0 before 11.0.3 |
| CVE-2017-0890 | 5.4 | May 8 | Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module Affected: before 11.0.3 |
| CVE-2016-9465 | 5.4 | Mar 28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export Affected: 10.0.0 before 10.0.1 |
| CVE-2016-7419 | 5.4 | Sep 17 | Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated… Affected: through 9.0.51 |
| CVE-2025-47791 | 5.3 | May 16 | Nextcloud Server is a self hosted personal cloud system Affected: 28.0.0 before 28.0.13; 28.0.0 before 28.0.13; 29.0.0 before 29.0.10; 29.0.0 before 29.0.10; 30.0.0 before 30.0.3; 30.0.0 before 30.0.3 |
| CVE-2024-52521 | 5.3 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 28.0.0 before 28.0.10; 28.0.0 before 28.0.10; 29.0.0 before 29.0.7; 29.0.0 before 29.0.7 |
| CVE-2023-39959 | 5.3 | Aug 10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 25.0.0 before 25.0.9; 25.0.0 before 25.0.9; 26.0.0 before 26.0.4; 26.0.0 before 26.0.4; 27.0.0; 27.0.0 |
| CVE-2023-39958 | 5.3 | Aug 10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 22.0.0 before 22.2.10.14; 23.0.0 before 23.0.12.9; 24.0.0 before 24.0.12.5; 25.0.0 before 25.0.9; 25.0.0 before 25.0.9; 26.0.0 before 26.0.4; +3 more |
| CVE-2023-25162 | 5.3 | Feb 13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform Affected: before 23.0.12; 24.0.0 before 24.0.8 |
| CVE-2023-25161 | 5.3 | Feb 13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform Affected: before 23.0.12; 24.0.0 before 24.0.8; 25.0.0 |
| CVE-2023-25159 | 5.3 | Feb 13 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform Affected: 24.0.4 through 24.0.8; 24.0.2; 25.0.0 |
| CVE-2022-41970 | 5.3 | Dec 1 | Nextcloud Server is an open source personal cloud server Affected: 24.0.0 before 24.0.7; 24.0.0 before 24.0.7; 25.0.0; 25.0.0 |
| CVE-2022-41968 | 5.3 | Dec 1 | Nextcloud Server is an open source personal cloud server Affected: 23.0.0 before 23.0.10; 23.0.0 before 23.0.10; 24.0.0 before 24.0.5; 24.0.0 before 24.0.5 |
| CVE-2022-39329 | 5.3 | Oct 27 | Profile of disabled user stays accessible Affected: before 23.0.9; 24.0.0 before 24.0.5 |
| CVE-2022-39211 | 5.3 | Sep 16 | Nextcloud server is an open source personal cloud platform Affected: before 23.0.8; 24.0.0 before 24.0.4 |
| CVE-2022-31118 | 5.3 | Aug 4 | Missing brute force protection on cloud federation sharing in Nextcloud Server Affected: before 22.2.9; 23.0.0 before 23.0.6; 24.0.0 before 24.0.2 |
| CVE-2021-41233 | 5.3 | Mar 10 | Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server Affected: before 20.0.14; 21.0.0 before 21.0.6; 22.2.0 before 22.2.1 |
| CVE-2021-41239 | 5.3 | Mar 8 | Nextcloud server is a self hosted system designed to provide cloud style services Affected: before 20.0.14; 21.0.0 before 21.0.6; 22.2.0 |
| CVE-2021-32766 | 5.3 | Sep 7 | Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server Affected: before 20.0.12; 21.0.0 before 21.0.4; 22.0.0 before 22.1.0 |
| CVE-2021-32741 | 5.3 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2021-32734 | 5.3 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2021-32725 | 5.3 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2021-32703 | 5.3 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2021-32678 | 5.3 | Jul 12 | Nextcloud Server is a Nextcloud package that handles data storage Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2020-8133 | 5.3 | Nov 9 | A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file Affected: 19.0.1 |
| CVE-2019-15623 | 5.3 | Feb 4 | Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the… Affected: before 14.0.13; 15.0.0 before 15.0.9; 16.0.0 before 16.0.2 |
| CVE-2018-16467 | 5.3 | Oct 30 | A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares Affected: before 14.0.0 |
| CVE-2018-16465 | 5.3 | Oct 30 | Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load Affected: before 14.0.0 |
| CVE-2018-3776 | 5.3 | Aug 12 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log Affected: 11.0.0 before 11.0.5; 12.0.0 before 12.0.3 |
| CVE-2016-9468 | 5.3 | Mar 28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app Affected: before 9.0.54; 10.0.0 through 10.0.1 |
| CVE-2016-9467 | 5.3 | Mar 28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app Affected: before 9.0.54; 10.0.0 before 10.0.1 |
| CVE-2020-8118 | 5.0 | Feb 4 | An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application Affected: before 15.0.9; 16.0.0 before 16.0.2 |
| CVE-2025-66510 | 4.9 | Dec 5 | Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list Affected: 28.0.0 before 28.0.14.11; 29.0.0 before 29.0.16.8; 30.0.0 before 30.0.17.3; 31.0.0 before 31.0.10; 31.0.0 before 31.0.10; 32.0.0 before 32.0.1 |
| CVE-2019-15624 | 4.9 | Feb 4 | Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders Affected: before 14.0.11; 15.0.0 before 15.0.8 |
| CVE-2021-22878 | 4.8 | Mar 3 | Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show` Affected: before 20.0.6 |
| CVE-2019-15619 | 4.8 | Feb 4 | Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them… Affected: before 16.0.4 |
| CVE-2019-15618 | 4.8 | Feb 4 | Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location Affected: before 14.0.9; 15.0.0 before 15.0.6 |
| CVE-2019-5451 | 4.6 | Jul 30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time Affected: before 3.6.1 |
| CVE-2023-48305 | 4.4 | Nov 21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 25.0.0 before 25.0.11; 25.0.0 before 25.0.11; 26.0.0 before 26.0.6; 26.0.0 before 26.0.6; 27.0.0 before 27.1.0; 27.0.0 before 27.1.0 |
| CVE-2020-8152 | 4.4 | Nov 16 | Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on Affected: before 20.0.0 |
| CVE-2026-45283 | 4.3 | Jun 1 | Nextcloud: Files Lock app allows users to lock and unlock files of other users Affected: 32.0.0 before 32.0.2; 33.0.0 before 33.0.1; 31.0.0 before 31.0.14.4; 32.0.0 before 32.0.2; 33.0.0 before 33.0.1 |
| CVE-2025-64011 | 4.3 | Dec 12 | Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint Affected: 30.0.0 |
| CVE-2025-66552 | 4.3 | Dec 5 | Nextcloud Server admin_audit does not log all actions on files in groupfolders Affected: 30.0.0 before 30.0.9; 30.0.0 before 30.0.9; 31.0.0 before 31.0.1; 31.0.0 before 31.0.1 |
| CVE-2025-66547 | 4.3 | Dec 5 | Nextcloud Server users can modify tags on files that do not belong to them Affected: 31.0.0 before 31.0.1; 31.0.0 before 31.0.1 |
| CVE-2025-47794 | 4.3 | May 16 | Nextcloud Server is a self hosted personal cloud system Affected: 26.0.0 before 26.0.13.13; 27.0.0 before 27.1.11.13; 28.0.0 before 28.0.14.4; 29.0.0 before 29.0.13; 29.0.0 before 29.0.13; 30.0.0 before 30.0.7; +3 more |
| CVE-2024-52513 | 4.3 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 25.0.0 before 25.0.13.13; 26.0.0 before 26.0.13.9; 27.0.0 before 27.1.11.9; 28.0.0 before 28.0.11; 28.0.0 before 28.0.11; 29.0.0 before 29.0.8; +3 more |
| CVE-2024-52516 | 4.3 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 26.0.0 before 26.0.13.9; 27.0.0 before 27.1.11.9; 28.0.0 before 28.0.9; 28.0.0 before 28.0.9; 29.0.0 before 29.0.5; 29.0.0 before 29.0.5 |
| CVE-2024-37315 | 4.3 | Jun 14 | Nextcloud Server is a self hosted personal cloud system Affected: 23.0.0 through 23.0.12; 24.0.0 through 24.0.12; 25.0.0 before 25.0.13; 26.0.0 before 26.0.12; 26.0.0 before 26.0.12; 27.0.0 before 27.1.7; +3 more |
| CVE-2023-48304 | 4.3 | Nov 21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 22.0.0 through 22.2.10.16; 23.0.0 before 23.0.12.11; 24.0.0 before 24.0.12.7; 25.0.0 before 25.0.11; 25.0.0 before 25.0.11; 26.0.0 before 26.0.6; +3 more |