SE
Product
security-advisories
53
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 38Low 9
Watch
Add security-advisories to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45810 | 6.8 | Jun 1 | Nextcloud: Propfind requests for file comments allowed to load comments for other files Affected: >= 31.0.0, < 31.0.12; >= 32.0.0, < 32.0.3 |
| CVE-2026-45282 | 6.5 | Jun 1 | Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access Affected: >= 32.0.0, < 32.0.9; >= 33.0.0, < 33.0.3 |
| CVE-2026-45279 | 6.5 | Jun 1 | Nextcloud: Limited path traversal via template API if using `{lang}` in config Affected: >= 31.0.0, < 31.0.14; >= 32.0.0, < 32.0.4 |
| CVE-2026-45275 | 6.5 | Jun 1 | Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers Affected: < 2.7.2 |
| CVE-2026-45267 | 6.5 | Jun 1 | Nextcloud: Missing permission check for from submissions Affected: < 5.2.6 |
| CVE-2025-66511 | 6.5 | Dec 5 | Nextcloud Calendar app used predictable proposal participant tokens Affected: >= 6.0.0-rc.1, < 6.0.3 |
| CVE-2025-58051 | 6.5 | Oct 16 | Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table Affected: >= 0.7.0, < 0.7.6; >= 0.8.0, < 0.8.8; >= 0.9.0, < 0.9.5 |
| CVE-2022-39364 | 6.5 | Oct 27 | Exception logging in Sharepoint app reveals clear-text connection details Affected: < 22.2.10.5; >= 23.0.0, < 23.0.9; >= 24.0.0, < 24.0.5 |
| CVE-2026-45285 | 6.4 | Jun 1 | Nextcloud: Hidden Public Link creation when sharing to a Team External Member Affected: >= 32.0.0, < 32.0.9; >= 33.0.0, < 33.0.3 |
| CVE-2026-45157 | 6.3 | Jun 1 | Nextcloud: Valid share tokens allow to access tempory upload files of share owner Affected: >= 32.0.0, < 32.0.9; >= 33.0.0, < 33.0.3 |
| CVE-2026-45278 | 6.1 | Jun 1 | Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass Affected: >= 6.1.0, < 8.2.2 |
| CVE-2025-66512 | 6.1 | Dec 5 | Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud Affected: >= 32.0.0beta1, < 32.0.3; < 31.0.12 |
| CVE-2026-45691 | 5.9 | Jun 1 | Nextcloud: Bypass of second factor authentication on DAV endpoints Affected: >= 32.0.0, < 32.0.9; >= 33.0.0, < 33.0.3 |
| CVE-2026-45690 | 5.9 | Jun 1 | Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay Affected: >= 32.0.0, < 32.0.9; >= 33.0.0, < 33.0.3 |
| CVE-2025-66550 | 5.7 | Dec 5 | Nextcloud Calendar attachments of local files are offered to downloaded Affected: >= 5.0.0-rc.1, < 5.2.4; < 4.7.17 |
| CVE-2025-66548 | 5.5 | Dec 5 | Nextcloud Deck app allows to spoof file extensions by using RTLO characters Affected: >= 1.15.0-beta.1, < 1.15.1; >= 1.14.0-beta.1, < 1.14.4; < 1.12.7 |
| CVE-2025-66554 | 5.4 | Dec 5 | Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field Affected: >= 7.0.0-alpha.1, < 7.2.5; >= 6.0.0-alpha1, < 6.0.6; < 5.5.4 |
| CVE-2025-66514 | 5.4 | Dec 5 | Nextcloud Mail stored HTML injection in subject text Affected: >= 5.2.0-beta.1, < 5.5.3 |
| CVE-2026-45543 | 5.3 | Jun 1 | Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share Affected: >= 4.3.0, < 5.2.7 |
| CVE-2025-66513 | 5.3 | Dec 5 | Nextcloud Tables app share information not limited to relevant users Affected: >= 1.0.0-beta.1, < 1.0.1; >= 0.9.0-beta.1, < 0.9.6; < 0.8.9 |
| CVE-2022-39329 | 5.3 | Oct 27 | Profile of disabled user stays accessible Affected: < 23.0.9; >= 24.0.0, < 24.0.5 |
| CVE-2022-31118 | 5.3 | Aug 4 | Missing brute force protection on cloud federation sharing in Nextcloud Server Affected: < 22.2.9; >= 23.0.0, < 23.0.6; >= 24.0.0, < 24.0.2 |
| CVE-2025-66510 | 4.9 | Dec 5 | Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list Affected: >= 32.0.0beta1, < 32.0.1; < 31.0.10 |
| CVE-2022-31119 | 4.9 | Aug 4 | Password disclosure in log file in Nextcloud Mail App Affected: < 1.12.1 |
| CVE-2026-45153 | 4.6 | Jun 1 | Nextcloud: PIN bypass in PassCodeActivity via back button Affected: >= 33.0.0, < 33.1.0 |
| CVE-2026-45544 | 4.3 | Jun 1 | Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService Affected: >= 0.8.0, < 1.0.4 |
| CVE-2026-45286 | 4.3 | Jun 1 | Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint Affected: >= 5.5.13, < 5.5.17; >= 6.2.0, < 6.2.3 |
| CVE-2026-45283 | 4.3 | Jun 1 | Nextcloud: Files Lock app allows users to lock and unlock files of other users Affected: >= 32.0.0, < 32.0.2; >= 33.0.0, < 33.0.1 |
| CVE-2026-45264 | 4.3 | Jun 1 | Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames Affected: >= 17.0.0, < 17.0.15; >= 18.0.0, < 18.1.12; >= 19.0.0, < 19.1.16; >= 20.0.0, < 20.1.11; >= 21.0.0, < 21.0.4 |
| CVE-2025-66558 | 4.3 | Dec 5 | Nextcloud Twofactor WebAuthn app was updated based on public key Affected: < 1.4.2; >= 2.0.0-beta.1, < 2.4.1 |
| CVE-2025-66556 | 4.3 | Dec 5 | Nextcloud talk allows participants to blindly delete poll drafts of other users by ID Affected: < 20.1.8; >= 21.0.0-beta.1, < 21.1.2 |
| CVE-2025-66545 | 4.3 | Dec 5 | Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin Affected: < 14.0.11; >= 15.0.0-beta1, < 15.3.12; >= 16.0.0, < 16.0.15; >= 17.0.0-beta.1, < 17.0.14; >= 18.0.0-beta.1, < 18.1.8; >= 19.0.0-alpha.1, < 19.1.8; +1 more |
| CVE-2025-66557 | 4.3 | Dec 5 | Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners Affected: >= 1.15.0-beta.1, < 1.15.2; < 1.14.6 |
| CVE-2025-66553 | 4.3 | Dec 5 | Nextcloud Tables app allowed users to view columns metadata information of any table Affected: >= 0.9.0-beta.1, < 0.9.4; < 0.8.7 |
| CVE-2025-66551 | 4.3 | Dec 5 | Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users Affected: >= 0.9.0-beta.1, < 0.9.3; < 0.8.6 |
| CVE-2025-66552 | 4.3 | Dec 5 | Nextcloud Server admin_audit does not log all actions on files in groupfolders Affected: >= 32.0.0beta1, < 32.0.1; < 31.0.9 |
| CVE-2025-66547 | 4.3 | Dec 5 | Nextcloud Server users can modify tags on files that do not belong to them Affected: < 31.0.1 |
| CVE-2022-39330 | 4.3 | Oct 27 | Database resource exhaustion for logged-in users via sharee recommendations with circles Affected: >= 23.0.0, < 23.0.9; >= 24.0.0, < 24.0.5; < 22.2.10 |
Showing 38