Skip to content
OpenAdvisories

Vendor

Nextcloud

306 known vulnerabilities.

Products

security-advisories 260 Nextcloud Server 16 Server 7 Collectives 2 com.nextcloud.client 2 Tables 2 nextcloudpi 1 news 1 Nextcloud Contacts application 1 cookbook 1 news-android 1 Deck 1 Files Confidential 1 Richdocuments 1 Nextcloud Calendar application 1 whiteboard 1 nextcloud/talk 1 Team Folders 1 Nextcloud 1 Files Lock 1 Approval 1 android 1 nextcloud-dialogs 1 Nextcloud Server < 26.0.2 0 Nextcloud Server < 25.0.7 0 Nextcloud Server < 24.0.12.2 0 Nextcloud Server < 23.0.12.7 0 Nextcloud Server < 22.2.10.12 0 Nextcloud Server < 21.0.9.12 0 Nextcloud Server < 20.0.14.14 0 Nextcloud Server < 19.0.13.9 0 Nextcloud desktop Client < 3.6.3 0 Nextcloud mail < 1.15.0 0 Nextcloud mail < 2.2.2 0 Nextcloud Server < 24.0.12.5 0 Nextcloud Server < 23.0.12.9 0 Nextcloud Server < 22.2.10.14 0 Nextcloud < Mail 3.3.0 0 Nextcloud < Server 25.0.11 0 Nextcloud < Server 26.0.6 0
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.1
    CVE-2026-45156 Public exploit

    Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

    Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This …

    Nextcloud security-advisories
  • Medium 4.2
    CVE-2024-52510 Public exploit

    Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty

    The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It i…

    Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  • Medium 5.3
    CVE-2023-49792 Public exploit

    Bruteforce protection can be bypassed with misconfigured proxy

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a…

    Nextcloud security-advisories
  • Critical 9.1
    CVE-2023-26482 Public exploit

    Scope of workflow operations is not validated in nextcloud server

    Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defin…

    Nextcloud security-advisories