What’s Vulnerable › Products

Nextcloud Talk vulnerabilities

20 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your Nextcloud Talk version is affected

Latest Nextcloud Talk vulnerabilities

• CVE-2025-66556 — Nextcloud talk allows participants to blindly delete poll drafts of other users by ID (CVSS 4.3)
• CVE-2023-45149 — Password of talk conversations can be bruteforced in Nextcloud (CVSS 4.3)
• CVE-2023-39957 — Path traversal allows tricking the Talk Android app into writing files into it's root directory (CVSS 7.8)
• CVE-2023-30540 — Chat poll data can still be queried from API after purging history in Nextcloud talk (CVSS 4.3)
• CVE-2023-28845 — Chat room membership disclosed via autocompletion in Nextcloud talk (CVSS 3.5)
• CVE-2023-22473 — Passcode bypass on Talk-Android app (CVSS 2.1)
• CVE-2022-41926 — Nextcloud Talk Android broadcast incorrect permission handling (CVSS 5.5)
• CVE-2022-39212 — Last video frame is still sent after video is disabled in a call in Nextcloud Talk (CVSS 5.3)
• CVE-2022-35932 — Missing rate limit when trying to join a password protected Nextcloud Talk conversation (CVSS 5.3)
• CVE-2022-24890 — Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk (CVSS 4.3)
• CVE-2022-24887 — Open Redirect in Nextcloud Talk (CVSS 6.1)
• CVE-2021-41181 — Nextcloud Talk app exposes chat messages on lockscreen (CVSS 2.4)
• CVE-2021-41180 — Geolocation preview links can be set to arbitrary links in nextcloud talk (CVSS 6.1)
• CVE-2021-39222 — XSS in Talk (CVSS 6.1)
• CVE-2021-32689 — Nextcloud Talk not properly disassociating users from chats after account deletion (CVSS 6.5)
• CVE-2021-32676 — Session Fixation in Nextcloud Talk (CVSS 6.5)
• CVE-2020-8180 — (CVSS 9.9)
• CVE-2019-15620 — (CVSS 2.7)
• CVE-2019-15619 — (CVSS 4.8)
• CVE-2018-3781 — (CVSS 5.4)