What’s Vulnerable › Products
Nextcloud Server vulnerabilities
189 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.
Check whether your Nextcloud Server version is affected
Latest Nextcloud Server vulnerabilities
- CVE-2026-45810 — Nextcloud: Propfind requests for file comments allowed to load comments for other files (CVSS 6.8)
- CVE-2026-45691 — Nextcloud: Bypass of second factor authentication on DAV endpoints (CVSS 5.9)
- CVE-2026-45690 — Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay (CVSS 5.9)
- CVE-2026-45285 — Nextcloud: Hidden Public Link creation when sharing to a Team External Member (CVSS 6.4)
- CVE-2026-45283 — Nextcloud: Files Lock app allows users to lock and unlock files of other users (CVSS 4.3)
- CVE-2026-45282 — Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access (CVSS 6.5)
- CVE-2026-45281 — Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update (CVSS 8.1)
- CVE-2026-45279 — Nextcloud: Limited path traversal via template API if using `{lang}` in config (CVSS 6.5)
- CVE-2025-64011 — (CVSS 4.3)
- CVE-2025-66552 — Nextcloud Server admin_audit does not log all actions on files in groupfolders (CVSS 4.3)
- CVE-2025-66547 — Nextcloud Server users can modify tags on files that do not belong to them (CVSS 4.3)
- CVE-2025-66512 — Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud (CVSS 6.1)
- CVE-2025-66510 — Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list (CVSS 4.9)
- CVE-2025-59788 — (CVSS 5.4)
- CVE-2025-47794 — Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission (CVSS 4.3)
- CVE-2025-47793 — Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file (CVSS 6.5)
- CVE-2025-47791 — Nextcloud Server's test remote endpoint is not rate limited (CVSS 5.3)
- CVE-2025-47790 — Nextcloud Server doesn't request second factor after session timeout (CVSS 6.4)
- CVE-2024-52514 — Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control (CVSS 3.5)
- CVE-2024-52513 — Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares (CVSS 4.3)
- CVE-2024-52525 — Nextcloud Server User password is available in memory of the PHP process (CVSS 7.5)
- CVE-2024-52523 — Nextcloud Server Custom defined credentials of external storages are sent back to the frontend (CVSS 6.5)
- CVE-2024-52521 — Nextcloud Server has a potential hash collision for background jobs could skip queuing them (CVSS 5.3)
- CVE-2024-52520 — Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended (CVSS 6.5)
- CVE-2024-52519 — Nextcloud Server's OAuth2 client secrets were stored in a recoverable way (CVSS 8.2)