NE
Product
nextcloud/server
189
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 42Medium 125Low 15
Watch
Add nextcloud/server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45810 | 6.8 | Jun 1 | Nextcloud: Propfind requests for file comments allowed to load comments for other files Affected: 31.0.0 before 31.0.12; 32.0.0 before 32.0.3; 21.0.0 before 21.0.9.20; 22.0.0 before 22.2.10.35; 23.0.0 before 23.0.12.31; 24.0.0 before 24.0.12.30; +8 more |
| CVE-2020-8236 | 6.8 | Nov 2 | A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the… Affected: before 19.0.2 |
| CVE-2023-32318 | 6.7 | May 26 | Nextcloud server provides a home for data Affected: 25.0.2 before 25.0.6; 25.0.2 before 25.0.6; 26.0.0; 26.0.0 |
| CVE-2020-8296 | 6.7 | Mar 3 | Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured Affected: before 20.0.0 |
| CVE-2026-45282 | 6.5 | Jun 1 | Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access Affected: 32.0.0 before 32.0.9; 33.0.0 before 33.0.3; 27.0.0 before 27.1.11.5; 28.0.0 before 28.0.14.17; 29.0.0 before 29.0.16.16; 30.0.0 before 30.0.17.9; +3 more |
| CVE-2026-45279 | 6.5 | Jun 1 | Nextcloud: Limited path traversal via template API if using `{lang}` in config Affected: 31.0.0 before 31.0.14; 32.0.0 before 32.0.4; 28.0.0 before 28.0.14.15; 29.0.0 before 29.0.17.12; 30.0.0 before 30.0.17.7; 31.0.0 before 31.0.14; +1 more |
| CVE-2025-47793 | 6.5 | May 16 | Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team Affected: 28.0.0 before 28.0.12; 29.0.0 before 29.0.9; 29.0.0 before 29.0.9; 30.0.0 before 30.0.2; 30.0.0 before 30.0.2 |
| CVE-2024-52523 | 6.5 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 25.0.0 before 25.0.13.14; 26.0.0 before 26.0.13.10; 27.0.0 before 27.1.11.10; 28.0.0 before 28.0.12; 28.0.0 before 28.0.12; 29.0.0 before 29.0.9; +3 more |
| CVE-2024-52520 | 6.5 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 27.0.0 before 27.1.11.8; 28.0.0 before 28.0.10; 28.0.0 before 28.0.10; 29.0.0 before 29.0.7; 29.0.0 before 29.0.7 |
| CVE-2024-52515 | 6.5 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 24.0.0 before 24.0.12.15; 25.0.0 before 25.0.13.10; 26.0.0 before 26.0.13.4; 27.0.0 before 27.1.10; 27.0.0 before 27.1.10; 28.0.0 before 28.0.6; +3 more |
| CVE-2023-39952 | 6.5 | Aug 10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 22.0.0 before 22.2.10.13; 23.0.0 before 23.0.12.8; 24.0.0 before 24.0.12.4; 25.0.0 before 25.0.8; 25.0.0 before 25.0.8; 26.0.0 before 26.0.3; +3 more |
| CVE-2023-32319 | 6.5 | May 26 | Nextcloud server is an open source personal cloud implementation Affected: 24.0.0 before 24.0.11; 25.0.0 before 25.0.5 |
| CVE-2023-28844 | 6.5 | Mar 31 | Nextcloud server is an open source home cloud implementation Affected: 24.0.4 before 24.0.10; 25.0.0 before 25.0.4 |
| CVE-2023-25816 | 6.5 | Feb 25 | Nextcloud is an Open Source private cloud software Affected: 25.0.0 before 25.0.3; 25.0.0 before 25.0.3 |
| CVE-2022-39346 | 6.5 | Nov 25 | Nextcloud server is an open source personal cloud server Affected: before 22.2.10; 23.0.0 before 23.0.7; 24.0.0 before 24.0.3 |
| CVE-2022-39364 | 6.5 | Oct 27 | Exception logging in Sharepoint app reveals clear-text connection details Affected: before 23.0.9; 24.0.0 before 24.0.5 |
| CVE-2022-24741 | 6.5 | Mar 9 | Nextcloud server is an open source, self hosted cloud style services platform Affected: 21.0.0 before 21.0.8; 22.0.0 before 22.2.4; 23.0.0 |
| CVE-2021-22877 | 6.5 | Mar 3 | A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet Affected: before 20.0.6 |
| CVE-2020-8293 | 6.5 | Jan 26 | A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later… Affected: before 18.0.11; 19.0.0 before 19.0.5; 20.0.0 before 20.0.2 |
| CVE-2020-8223 | 6.5 | Oct 5 | A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves Affected: 19.0.0 |
| CVE-2020-8139 | 6.5 | Mar 20 | A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL Affected: 16.0.0 before 16.0.9; 17.0.0 before 17.0.4; 18.0.0 before 18.0.1 |
| CVE-2020-8138 | 6.5 | Mar 20 | A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a… Affected: before 15.0.14; 16.0.0 before 16.0.7; 17.0.0 before 17.0.2 |
| CVE-2019-15621 | 6.5 | Feb 4 | Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as… Affected: before 14.0.13; 15.0.0 before 15.0.9; 16.0.0 before 16.0.2 |
| CVE-2017-0886 | 6.5 | Apr 5 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack Affected: before 9.0.55; 10.0.0 before 10.0.2 |
| CVE-2026-45285 | 6.4 | Jun 1 | Nextcloud: Hidden Public Link creation when sharing to a Team External Member Affected: 32.0.0 before 32.0.9; 33.0.0 before 33.0.3; 32.0.0 before 32.0.9; 33.0.0 before 33.0.3 |
| CVE-2025-47790 | 6.4 | May 16 | Nextcloud Server is a self hosted personal cloud system Affected: 26.0.0 before 26.0.13.15; 27.0.0 before 27.1.11.15; 28.0.0 before 28.0.14.6; 29.0.0 before 29.0.15; 29.0.0 before 29.0.15; 30.0.0 before 30.0.9; +3 more |
| CVE-2017-0883 | 6.4 | Apr 5 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue Affected: through 9.0.54; 10.0.2 |
| CVE-2025-66512 | 6.1 | Dec 5 | Nextcloud Server is a self hosted personal cloud system Affected: 31.0.0 before 31.0.12; 31.0.0 before 31.0.12; 32.0.0 before 32.0.3; 32.0.0 before 32.0.3 |
| CVE-2023-35171 | 6.1 | Jun 23 | NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform Affected: 26.0.0 before 26.0.2; 26.0.0 before 26.0.2 |
| CVE-2021-32733 | 6.1 | Jul 12 | Nextcloud Text is a collaborative document editing application that uses Markdown Affected: before 19.0.13; 20.0.0 before 20.0.11; 21.0.0 before 21.0.3 |
| CVE-2020-8120 | 6.1 | Feb 4 | A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation Affected: 16.0.1 |
| CVE-2016-9466 | 6.1 | Mar 28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application Affected: 10.0.0 before 10.0.1 |
| CVE-2016-9459 | 6.1 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS Affected: before 9.0.52 |
| CVE-2026-45691 | 5.9 | Jun 1 | Nextcloud: Bypass of second factor authentication on DAV endpoints Affected: 32.0.0 before 32.0.9; 33.0.0 before 33.0.3; 29.0.0 before 29.0.16.16; 30.0.0 before 30.0.17.9; 31.0.0 before 31.0.14.5; 32.0.0 before 32.0.9; +1 more |
| CVE-2026-45690 | 5.9 | Jun 1 | Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay Affected: 32.0.0 before 32.0.9; 33.0.0 before 33.0.3; 29.0.0 before 29.0.16.16; 30.0.0 before 30.0.17.9; 31.0.0 before 31.0.14.5; 32.0.0 before 32.0.9; +1 more |
| CVE-2024-52517 | 5.9 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 25.0.0 before 25.0.13.13; 26.0.0 before 26.0.13.9; 27.0.0 before 27.1.11.9; 28.0.0 before 28.0.11; 28.0.0 before 28.0.11; 29.0.0 before 29.0.8; +3 more |
| CVE-2019-15612 | 5.9 | Feb 4 | A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset Affected: 13.0.0 before 13.0.11; 14.0.0 before 14.0.7; 15.0.0 before 15.0.3 |
| CVE-2018-16464 | 5.7 | Oct 30 | A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password Affected: before 14.0.0 |
| CVE-2017-0936 | 5.7 | Mar 28 | Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability Affected: before 11.0.7; 12.0.5 |
| CVE-2021-32801 | 5.5 | Sep 7 | Nextcloud server is an open source, self hosted personal cloud Affected: before 20.0.12; 21.0.0 before 21.0.4; 22.0.0 before 22.1.0 |
| CVE-2025-59788 | 5.4 | Dec 4 | Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23,… Affected: 30.0.0 before 30.0.17; 31.0.0 before 31.0.10; 32.0.0 before 32.0.1; 22.0.0 before 22.2.10.33; 23.0.0 before 23.0.12.29; 24.0.0 before 24.0.12.28; +8 more |
| CVE-2024-52518 | 5.4 | Nov 15 | Nextcloud Server is a self hosted personal cloud system Affected: 28.0.0 before 28.0.12; 28.0.0 before 28.0.12; 29.0.0 before 29.0.9; 29.0.0 before 29.0.9; 30.0.0 before 30.0.2; 30.0.0 before 30.0.2 |
| CVE-2024-37884 | 5.4 | Jun 14 | Nextcloud Server is a self hosted personal cloud system Affected: 25.0.0 before 25.0.13.7; 26.0.0 before 26.0.13; 26.0.0 before 26.0.13; 27.0.0 before 27.1.8; 27.0.0 before 27.1.8; 28.0.0 before 28.0.4; +1 more |
| CVE-2023-49791 | 5.4 | Dec 22 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 23.0.0 before 23.0.12.13; 24.0.0 before 24.0.12.9; 25.0.0 before 25.0.13.4; 26.0.0 before 26.0.9; 26.0.0 before 26.0.9; 27.0.0 before 27.1.4; +1 more |
| CVE-2023-48302 | 5.4 | Nov 21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 25.0.0 before 25.0.13; 25.0.0 before 25.0.13; 26.0.0 before 26.0.8; 26.0.0 before 26.0.8; 27.0.0 before 27.1.3; 27.0.0 before 27.1.3 |
| CVE-2023-48301 | 5.4 | Nov 21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform Affected: 25.0.0 through 25.0.13; 25.0.0 before 25.0.13; 26.0.0 through 26.0.8; 26.0.0 before 26.0.8; 27.0.0 through 27.1.3; 27.0.0 before 27.1.3 |
| CVE-2020-8294 | 5.4 | Feb 3 | A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in… Affected: before 18.0.11; 19.0.0 before 19.0.5; 20.0.0 before 20.0.2 |
| CVE-2020-8155 | 5.4 | May 12 | An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF Affected: before 18.0.3 |
| CVE-2019-15617 | 5.4 | Feb 4 | A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login Affected: before 17.0.1 |
| CVE-2018-3780 | 5.4 | Aug 13 | A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction Affected: >13.0.5 |