What’s Vulnerable › Products

Nextcloud Deck vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your Nextcloud Deck version is affected

Latest Nextcloud Deck vulnerabilities

• CVE-2026-77170 — (CVSS 4.3)
• CVE-2025-66557 — Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners (CVSS 4.3)
• CVE-2025-66548 — Nextcloud Deck app allows to spoof file extensions by using RTLO characters (CVSS 5.5)
• CVE-2024-37883 — Nextcloud Deck can access comments and attachments of deleted cards (CVSS 4.3)
• CVE-2024-22213 — Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app (CVSS 5.4)
• CVE-2023-22471 — Nextcloud Deck vulnerable to authorization bypass (CVSS 4.3)
• CVE-2023-22470 — Nextcloud Deck vulnerable to uncontrolled resource consumption (CVSS 6.5)
• CVE-2023-22469 — Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache (CVSS 3.5)
• CVE-2022-29159 — Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck (CVSS 4.3)
• CVE-2022-24906 — Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck (CVSS 4.3)
• CVE-2021-39225 — Missing permission check on Deck API (CVSS 8.1)
• CVE-2021-37631 — Circle can be accessed by non-Circle members in Nextcloud Deck (CVSS 6.5)
• CVE-2021-22913 — (CVSS 6.5)
• CVE-2020-8297 — (CVSS 4.3)
• CVE-2020-8235 — (CVSS 4.3)
• CVE-2020-8182 — (CVSS 8.0)
• CVE-2020-8179 — (CVSS 4.1)
• CVE-2019-15619 — (CVSS 4.8)