What’s Vulnerable › Products
Desktop Client vulnerabilities
27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.
Check whether your Desktop Client version is affected
Latest Desktop Client vulnerabilities
- CVE-2025-66549 — Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory (CVSS 2.7)
- CVE-2025-47792 — Nextcloud Desktop 3rdparty applications can create share links via socket API (CVSS 6.1)
- CVE-2024-52510 — Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty (CVSS 7.5)
- CVE-2024-46958 — (CVSS 9.1)
- CVE-2024-37885 — Code injection in Nextcloud Desktop Client for macOS (CVSS 7.8)
- CVE-2023-29000 — Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption (CVSS 6.5)
- CVE-2023-28999 — Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders (CVSS 6.4)
- CVE-2023-28998 — Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys (CVSS 6.1)
- CVE-2023-28997 — Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files (CVSS 6.5)
- CVE-2023-23942 — Self reflected HTML injection in Desktop client (CVSS 6.1)
- CVE-2023-22472 — Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link (CVSS 8.8)
- CVE-2022-39333 — Cross-site scripting (XSS) in Nextcloud Desktop Client (CVSS 6.1)
- CVE-2022-39332 — Cross-site scripting (XSS) in Nextcloud Desktop Client (CVSS 5.4)
- CVE-2022-39334 — nextcloudcmd incorrectly trusts bad TLS certificates (CVSS 4.7)
- CVE-2022-39331 — Cross-site Scripting (XSS) in Nexcloud Desktop Client (CVSS 5.4)
- CVE-2022-41882 — Nextcloud Desktop vulnerable to code injection via malicious link (CVSS 7.8)
- CVE-2021-37617 — Untrusted Search Path in Nextcloud Desktop Client (CVSS 7.3)
- CVE-2021-32728 — End-to-end encryption device setup did not verify public key (CVSS 6.5)
- CVE-2021-22895 — (CVSS 5.9)
- CVE-2021-22879 — (CVSS 8.8)
- CVE-2020-8225 — (CVSS 7.5)
- CVE-2020-8227 — (CVSS 6.8)
- CVE-2020-8189 — (CVSS 5.4)
- CVE-2020-8230 — (CVSS 5.5)
- CVE-2020-8229 — (CVSS 5.5)