Skip to content
Nextcloud Security-advisories vulnerabilities
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Propfind requests for file comments allowed to load comments for other files
CVE-2026-45810
Fix available
6.8 Medium
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
CVE-2026-45722
7.1 High
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Bypass of second factor authentication on DAV endpoints
CVE-2026-45691
Fix available
5.9 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
CVE-2026-45690
Fix available
5.9 Medium
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
CVE-2026-45545
8.2 High
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
CVE-2026-45544
4.3 Medium
-
nextcloud forms, kiteworks security-advisories +1 more
Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
CVE-2026-45543
5.3 Medium
-
nextcloud calendar, kiteworks security-advisories +1 more
Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint
CVE-2026-45286
4.3 Medium
-
nextcloud user oidc, kiteworks security-advisories +1 more
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
CVE-2026-45284
4.6 Medium
-
kiteworks security-advisories, nextcloud server +1 more
Nextcloud: Hidden Public Link creation when sharing to a Team External Member
CVE-2026-45285
6.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Files Lock app allows users to lock and unlock files of other users
CVE-2026-45283
6.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access
CVE-2026-45282
6.5 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
CVE-2026-45281
Fix available
8.1 High
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Limited path traversal via template API if using `{lang}` in config
CVE-2026-45279
4.4 Medium
-
nextcloud user oidc, kiteworks security-advisories +1 more
Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
CVE-2026-45278
3.3 Low
-
nextcloud approval, kiteworks security-advisories +1 more
Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations
CVE-2026-45277
3.3 Low
-
nextcloud approval, kiteworks security-advisories +1 more
Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers
CVE-2026-45275
6.5 Medium
-
kiteworks security-advisories
Nextcloud: Missing permission check for from submissions
CVE-2026-45267
6.5 Medium
-
kiteworks security-advisories
Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling
CVE-2026-45266
3.5 Low
-
kiteworks security-advisories
Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
CVE-2026-45159
3.5 Low
-
kiteworks security-advisories
Nextcloud: Valid share tokens allow to access tempory upload files of share owner
CVE-2026-45157
Fix available
6.3 Medium
-
kiteworks security-advisories
Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
CVE-2026-45156
Public exploit
8.1 High
-
kiteworks security-advisories
Nextcloud: Private circle can be added to another circle via API
CVE-2026-45155
2.6 Low
-
kiteworks security-advisories
Nextcloud: Improper Access Control in Collectives
CVE-2026-45154
2.6 Low
-
kiteworks security-advisories
Nextcloud: PIN bypass in PassCodeActivity via back button
CVE-2026-45153
Fix available
4.6 Medium
-
kiteworks security-advisories
Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames
CVE-2026-45264
4.3 Medium
-
kiteworks security-advisories, nextcloud two-factor webauthn +1 more
Nextcloud Twofactor WebAuthn app was updated based on public key
CVE-2025-66558
3.1 Low
-
nextcloud talk, kiteworks security-advisories +1 more
Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
CVE-2025-66556
3.5 Low
-
nextcloud contacts, kiteworks security-advisories +1 more
Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field
CVE-2025-66554
3.5 Low
-
nextcloud desktop, kiteworks security-advisories +1 more
Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory
CVE-2025-66549
Fix available
2.4 Low
-
kiteworks security-advisories, nextcloud group folders +1 more
Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin
CVE-2025-66545
3.5 Low
-
nextcloud approval, kiteworks security-advisories +1 more
Nextcloud Approval app allows users to request approval for other users file
CVE-2025-66515
2.7 Low
-
nextcloud mail, kiteworks security-advisories +1 more
Nextcloud Mail stored HTML injection in subject text
CVE-2025-66514
3.5 Low
-
nextcloud deck, kiteworks security-advisories +1 more
Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
CVE-2025-66557
5.4 Medium
-
nextcloud deck, kiteworks security-advisories +1 more
Nextcloud Deck app allows to spoof file extensions by using RTLO characters
CVE-2025-66548
3.3 Low
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud Tables app allowed users to view columns metadata information of any table
CVE-2025-66553
4.3 Medium
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users
CVE-2025-66551
6.3 Medium
-
nextcloud tables, kiteworks security-advisories +1 more
Nextcloud Tables app share information not limited to relevant users
CVE-2025-66513
4.3 Medium
-
nextcloud calendar, kiteworks security-advisories +1 more
Nextcloud Calendar attachments of local files are offered to downloaded
CVE-2025-66550
5.7 Medium
-
nextcloud calendar, kiteworks security-advisories +1 more
Nextcloud Calendar app allowed booking appointments without the generated token
CVE-2025-66546
3.3 Low
-
nextcloud calendar, kiteworks security-advisories +1 more
Nextcloud Calendar app used predictable proposal participant tokens
CVE-2025-66511
4.8 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server admin_audit does not log all actions on files in groupfolders
CVE-2025-66552
Fix available
4.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server users can modify tags on files that do not belong to them
CVE-2025-66547
Fix available
4.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
CVE-2025-66512
5.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
CVE-2025-66510
Fix available
4.5 Medium
-
kiteworks security-advisories
Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table
CVE-2025-58051
6.5 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission
CVE-2025-47794
2.6 Low
-
nextcloud server, kiteworks security-advisories, nextcloud group folders +2 more
Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file
CVE-2025-47793
4.3 Medium
-
nextcloud desktop, kiteworks security-advisories +1 more
Nextcloud Desktop 3rdparty applications can create share links via socket API
CVE-2025-47792
Fix available
5.0 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's test remote endpoint is not rate limited
CVE-2025-47791
4.3 Medium
- Show olderLoading…