Login Request a demo
NE
Vendor
Nextcloud
45 products with CVEs on record
438
CVEs
0
On KEV
9
New 30D
Products
SE
server
Nextcloud
7.5
9 CVEs0 on KEV3 new
TA
Tables
Nextcloud
8.2
10 CVEs0 on KEV2 new
RI
Richdocuments
Nextcloud
7.5
9 CVEs0 on KEV1 new
CO
Collectives
Nextcloud
3.5
2 CVEs0 on KEV1 new
FC
Files Confidential
Nextcloud
4.3
1 CVEs0 on KEV1 new
WH
whiteboard
Nextcloud
4.6
1 CVEs0 on KEV1 new
NE
nextcloud/server
NextCloud
9.8
189 CVEs0 on KEV0 new
SE
security-advisories
nextcloud
9.8
33 CVEs0 on KEV0 new
NE
Nextcloud
Nextcloud
9.8
28 CVEs0 on KEV0 new
DE
Desktop
Nextcloud
9.1
27 CVEs0 on KEV0 new
TA
Talk
Nextcloud
9.9
20 CVEs0 on KEV0 new
DE
Deck
Nextcloud
8.1
18 CVEs0 on KEV0 new
MA
Mail
Nextcloud
9.8
15 CVEs0 on KEV0 new
CA
Calendar
Nextcloud
9.8
10 CVEs0 on KEV0 new
UO
User Oidc
Nextcloud
9.8
9 CVEs0 on KEV0 new
CO
Contacts
Nextcloud
5.4
7 CVEs0 on KEV0 new
NE
Nextcloud Enterprise Server
Nextcloud
7.5
6 CVEs0 on KEV0 new
AP
Approval
Nextcloud
6.5
4 CVEs0 on KEV0 new
CI
Circles
Nextcloud
6.5
3 CVEs0 on KEV0 new
GF
Group Folders
Nextcloud
8.1
3 CVEs0 on KEV0 new
NE
nextcloud/talk
NextCloud
6.5
3 CVEs0 on KEV0 new
EE
End-to-end Encryption
Nextcloud
6.5
2 CVEs0 on KEV0 new
GU
Guests
Nextcloud
5.4
2 CVEs0 on KEV0 new
NE
news
nextcloud
7.1
2 CVEs0 on KEV0 new
NO
Notes
Nextcloud
6.1
2 CVEs0 on KEV0 new
OC
Openid Connect User Backend
Nextcloud
5.4
2 CVEs0 on KEV0 new
PP
Preferred Providers
Nextcloud
5.3
2 CVEs0 on KEV0 new
SO
Social
Nextcloud
7.4
2 CVEs0 on KEV0 new
CO
Cookbook
Nextcloud
8.8
1 CVEs0 on KEV0 new
EX
Extract
Nextcloud
8.8
1 CVEs0 on KEV0 new
FA
Files Access Control
Nextcloud
4.3
1 CVEs0 on KEV0 new
FL
Files Lock
Nextcloud
6.3
1 CVEs0 on KEV0 new
FL
Flow
Nextcloud
8.8
1 CVEs0 on KEV0 new
FO
Forms
Nextcloud
5.3
1 CVEs0 on KEV0 new
GS
Global Site Selector
Nextcloud
9.8
1 CVEs0 on KEV0 new
LO
Lookup-server
Nextcloud
9.8
1 CVEs0 on KEV0 new
NF
Nextcloud Files Automated Tagging
Nextcloud
8.8
1 CVEs0 on KEV0 new
NM
Nextcloud Mail
Nextcloud
4.3
1 CVEs0 on KEV0 new
NE
Nextcloudpi
Nextcloud
9.8
1 CVEs0 on KEV0 new
OF
Officeonline
Nextcloud
5.3
1 CVEs0 on KEV0 new
PP
Password Policy
Nextcloud
2.7
1 CVEs0 on KEV0 new
SS
Sso & Saml Authentication
Nextcloud
6.1
1 CVEs0 on KEV0 new
TF
Team Folders
Nextcloud
6.5
1 CVEs0 on KEV0 new
TW
Two-factor Webauthn
Nextcloud
4.3
1 CVEs0 on KEV0 new
ZI
Zipper
Nextcloud
4.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-82984
New
SE
Server
Nextcloud
4.3–Oct 27When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint…
CVE-2026-77167
New
SE
server
Nextcloud
7.5–Oct 27Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table
CVE-2026-77173
New
FC
Files Confidential
Nextcloud
4.3–Oct 27A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential
CVE-2026-67400
New
RI
Richdocuments
Nextcloud
3.5–Oct 27A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token
CVE-2026-77171
New
CO
Collectives
Nextcloud
3.5–Oct 27A public shared collective always allowed recipients of the link to create pages
CVE-2026-77172
New
SE
Server
Nextcloud
5.3–Oct 27App passwords were allowed to bypass password confirmation on sensitive endpoints
CVE-2026-87897
New
WH
whiteboard
Nextcloud
4.6–Oct 27A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user
CVE-2026-82983
New
TA
Tables
Nextcloud
3.3–Oct 27The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning…
CVE-2026-82986
New
TA
Tables
Nextcloud
4.6–Oct 27The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission
CVE-2026-77165
SE
Server
Nextcloud
6.5
0%
Sep 21File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database
CVE-2026-77166
CO
Collectives
Nextcloud
2.4
0%
Sep 21The emoji field in the page emoji update endpoint does not properly validate user input
CVE-2026-68493
SE
Server
Nextcloud
3.1
0%
Sep 18After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of
CVE-2026-82985
SE
Server
Nextcloud
6.5
0%
Sep 18The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album…
CVE-2026-77164
SE
Server
Nextcloud
6.2
0%
Sep 18Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private…
CVE-2026-77170
DE
Deck
Nextcloud
4.3
0%
Sep 18The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage…
CVE-2026-82982
AP
Approval
Nextcloud
4.3
0%
Sep 18The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose…
CVE-2026-77169
TF
Team Folders
Nextcloud
6.5
0%
Sep 18A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass…
CVE-2026-82980
FL
Files Lock
Nextcloud
6.3
0%
Sep 18Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users
CVE-2026-45810
SE
security-advisories
nextcloud
6.8
0%
Jun 1Nextcloud: Propfind requests for file comments allowed to load comments for other files
CVE-2026-45722
SE
security-advisories
nextcloud
7.1
0%
Jun 1Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
CVE-2026-45691
SE
security-advisories
nextcloud
5.9
0%
Jun 1Nextcloud: Bypass of second factor authentication on DAV endpoints
CVE-2026-45690
SE
security-advisories
nextcloud
5.9
0%
Jun 1Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
CVE-2026-45545
SE
security-advisories
nextcloud
8.2
0%
Jun 1Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
CVE-2026-45544
SE
security-advisories
nextcloud
4.3
0%
Jun 1Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
CVE-2026-45543
SE
security-advisories
nextcloud
5.3
0%
Jun 1Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
CVE-2026-45286
SE
security-advisories
nextcloud
4.3
0%
Jun 1Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
CVE-2026-45284
SE
security-advisories
nextcloud
8.8
0%
Jun 1Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
CVE-2026-45285
SE
security-advisories
nextcloud
6.4
0%
Jun 1Nextcloud: Hidden Public Link creation when sharing to a Team External Member
CVE-2026-45283
SE
security-advisories
nextcloud
4.3
0%
Jun 1Nextcloud: Files Lock app allows users to lock and unlock files of other users
CVE-2026-45282
SE
security-advisories
nextcloud
6.5
0%
Jun 1Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access
CVE-2026-45281
SE
security-advisories
nextcloud
8.1
0%
Jun 1Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
CVE-2026-45279
SE
security-advisories
nextcloud
6.5
0%
Jun 1Nextcloud: Limited path traversal via template API if using `{lang}` in config
CVE-2026-45278
SE
security-advisories
nextcloud
6.1
0%
Jun 1Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
CVE-2026-45277
SE
security-advisories
nextcloud
3.3
0%
Jun 1Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
CVE-2026-45275
SE
security-advisories
nextcloud
6.5
0%
Jun 1Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers
CVE-2026-45267
SE
security-advisories
nextcloud
6.5
0%
Jun 1Nextcloud: Missing permission check for from submissions
CVE-2026-45266
SE
security-advisories
nextcloud
3.5
0%
Jun 1Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling
CVE-2026-45159
SE
security-advisories
nextcloud
3.5
0%
Jun 1Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
CVE-2026-45157
SE
security-advisories
nextcloud
6.3
0%
Jun 1Nextcloud: Valid share tokens allow to access tempory upload files of share owner
CVE-2026-45156
SE
security-advisories
nextcloud
8.1
0%
Jun 1Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
CVE-2026-45155
SE
security-advisories
nextcloud
2.6
0%
Jun 1Nextcloud: Private circle can be added to another circle via API
CVE-2026-45154
SE
security-advisories
nextcloud
2.6
0%
Jun 1Nextcloud: Improper Access Control in Collectives
CVE-2026-45153
SE
security-advisories
nextcloud
4.6
0%
Jun 1Nextcloud: PIN bypass in PassCodeActivity via back button
CVE-2026-45264
SE
security-advisories
nextcloud
4.3
0%
Jun 1Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames
CVE-2026-44515
NE
news
nextcloud
2.3
0%
May 14Nextcloud News: Authenticated blind SSRF via feed URL
CVE-2026-22683
FL
Flow
Nextcloud
8.8
3%
Apr 7Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
CVE-2025-64011
NS
Nextcloud Server
Nextcloud
4.3
0%
Dec 12Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint
CVE-2025-66558
TW
Two-factor Webauthn
Nextcloud
4.3
0%
Dec 5Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud
CVE-2025-66557
DE
Deck
Nextcloud
4.3
0%
Dec 5Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud
CVE-2025-66556
TA
Talk
Nextcloud
4.3
0%
Dec 5Nextcloud talk is a video & audio conferencing app for Nextcloud
CVE-2025-66554
CO
Contacts
Nextcloud
5.4
0%
Dec 5Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing
CVE-2025-66553
TA
Tables
Nextcloud
4.3
0%
Dec 5Nextcloud Tables allows you to create your own tables with individual columns
CVE-2025-66551
TA
Tables
Nextcloud
4.3
0%
Dec 5Nextcloud Tables allows you to create your own tables with individual columns
CVE-2025-66549
DE
Desktop
Nextcloud
2.7
0%
Dec 5Nextcloud Desktop is the desktop sync client for Nextcloud
CVE-2025-66548
DE
Deck
Nextcloud
5.5
0%
Dec 5Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud
CVE-2025-66545
GF
Group Folders
Nextcloud
4.3
0%
Dec 5Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team
CVE-2025-66515
AP
Approval
Nextcloud
2.7
0%
Dec 5The Nextcloud Approval app allows approval or disapproval of files in the sidebar
CVE-2025-66514
MA
Mail
Nextcloud
5.4
0%
Dec 5Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
CVE-2025-66513
TA
Tables
Nextcloud
5.3
0%
Dec 5Nextcloud Tables allows you to create your own tables with individual columns
CVE-2025-66552
NS
Nextcloud Server
Nextcloud
4.3
0%
Dec 5Nextcloud Server is a self hosted personal cloud system