Skip to content
Nextcloud Server vulnerabilities
-
devolutions server
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be calle…
CVE-2026-82984
4.3 Medium
-
devolutions server
App passwords were allowed to bypass password confirmation on sensitive endpoints.
CVE-2026-77172
5.3 Medium
-
devolutions server
Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three d…
CVE-2026-77167
7.5 High
-
devolutions server
File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files...
CVE-2026-77165
Fix available
6.5 Medium
-
devolutions server
The Photos app's filter-based "smart albums" build their file listing using the search...
CVE-2026-82985
Fix available
6.5 Medium
-
devolutions server
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before...
CVE-2026-77164
Fix available
6.2 Medium
-
devolutions server
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve...
CVE-2026-68493
Fix available
3.1 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Propfind requests for file comments allowed to load comments for other files
CVE-2026-45810
Fix available
6.8 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Bypass of second factor authentication on DAV endpoints
CVE-2026-45691
Fix available
5.9 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay
CVE-2026-45690
Fix available
5.9 Medium
-
kiteworks security-advisories, nextcloud server +1 more
Nextcloud: Hidden Public Link creation when sharing to a Team External Member
CVE-2026-45285
6.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Files Lock app allows users to lock and unlock files of other users
CVE-2026-45283
6.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access
CVE-2026-45282
6.5 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
CVE-2026-45281
Fix available
8.1 High
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud: Limited path traversal via template API if using `{lang}` in config
CVE-2026-45279
4.4 Medium
-
nextcloud server
Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core...
CVE-2025-64011
4.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server admin_audit does not log all actions on files in groupfolders
CVE-2025-66552
Fix available
4.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server users can modify tags on files that do not belong to them
CVE-2025-66547
Fix available
4.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud
CVE-2025-66512
5.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list
CVE-2025-66510
Fix available
4.5 Medium
-
nextcloud, nextcloud server +1 more
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in...
CVE-2025-59788
6.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission
CVE-2025-47794
2.6 Low
-
nextcloud server, kiteworks security-advisories, nextcloud group folders +2 more
Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file
CVE-2025-47793
4.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's test remote endpoint is not rate limited
CVE-2025-47791
4.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server doesn't request second factor after session timeout
CVE-2025-47790
6.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares
CVE-2024-52513
2.6 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control
CVE-2024-52514
4.1 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews
CVE-2024-52515
5.7 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them
CVE-2024-52516
3.0 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's global credentials of external storages are sent back to the frontend
CVE-2024-52517
4.6 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server is missing password confirmation when changing external storage options
CVE-2024-52518
4.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
CVE-2024-52519
2.7 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended
CVE-2024-52520
5.7 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server has a potential hash collision for background jobs could skip queuing them
CVE-2024-52521
2.6 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server Custom defined credentials of external storages are sent back to the frontend
CVE-2024-52523
4.6 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server User password is available in memory of the PHP process
CVE-2024-52525
1.8 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's events information leaked with shared calendars on recurrence exceptions
CVE-2024-37887
3.5 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's users can delete old versions of read-only shared files
CVE-2024-37884
3.5 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server can reshare read&share only folder with more permissions
CVE-2024-37882
8.1 High
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server's read-only users can restore old versions
CVE-2024-37315
3.5 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Photos' shared albums have no restriction on photo removal
CVE-2024-37314
3.5 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud server allows the by-pass the second factor
CVE-2024-37313
7.3 High
-
nextcloud server, kiteworks security-advisories +1 more
OAuth2 authorization codes are valid indefinetly in Nextcloud server
CVE-2024-22403
3.0 Low
-
nextcloud server, kiteworks security-advisories +1 more
Bruteforce protection can be bypassed with misconfigured proxy
CVE-2023-49792
Public exploit
5.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Workflows do not require password confirmation on API level
CVE-2023-49791
5.4 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF
CVE-2023-48306
5.0 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server user_ldap app logs user passwords in the log file on level debug
CVE-2023-48305
4.2 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user
CVE-2023-48304
4.3 Medium
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server admins can change authentication details of user configured external storage
CVE-2023-48303
2.4 Low
-
nextcloud server, kiteworks security-advisories +1 more
Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V
CVE-2023-48302
3.5 Low
- Show olderLoading…