Skip to content
OpenAdvisories

Vendor

Nextcloud

306 known vulnerabilities.

Products

security-advisories 260 Nextcloud Server 16 Server 7 Collectives 2 com.nextcloud.client 2 Tables 2 nextcloudpi 1 news 1 Nextcloud Contacts application 1 cookbook 1 news-android 1 Deck 1 Files Confidential 1 Richdocuments 1 Nextcloud Calendar application 1 whiteboard 1 nextcloud/talk 1 Team Folders 1 Nextcloud 1 Files Lock 1 Approval 1 android 1 nextcloud-dialogs 1 Nextcloud Server < 26.0.2 0 Nextcloud Server < 25.0.7 0 Nextcloud Server < 24.0.12.2 0 Nextcloud Server < 23.0.12.7 0 Nextcloud Server < 22.2.10.12 0 Nextcloud Server < 21.0.9.12 0 Nextcloud Server < 20.0.14.14 0 Nextcloud Server < 19.0.13.9 0 Nextcloud desktop Client < 3.6.3 0 Nextcloud mail < 1.15.0 0 Nextcloud mail < 2.2.2 0 Nextcloud Server < 24.0.12.5 0 Nextcloud Server < 23.0.12.9 0 Nextcloud Server < 22.2.10.14 0 Nextcloud < Mail 3.3.0 0 Nextcloud < Server 25.0.11 0 Nextcloud < Server 26.0.6 0
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 10.0
    CVE-2024-30247

    Command Injection as root in NextCloudPi web panel

    NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. A command injection vulnerability in NextCloudPi allows command execution as the root user via the NextCloudPi web-panel. Due to a security misconfigu…

    Nextcloud nextcloudpi
  • Critical 9.7
    CVE-2024-22212

    Nextcloud global site selector authentication bypass

    Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended tha…

    Nextcloud security-advisories
  • Critical 9.1
    CVE-2023-26482 Public exploit

    Scope of workflow operations is not validated in nextcloud server

    Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defin…

    Nextcloud security-advisories
  • Critical 9.3
    CVE-2021-32802

    Preview generation used third-party library not suited for user-generated content in Nextcloud server

    Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-sup…

    Nextcloud security-advisories