nextcloud vulnerabilities
Every vulnerability this feed holds for nextcloud, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
9 vulnerabilities tracked.
- 7.5 Abusing the federated share endpoint, an attacker can write arbitrary rows into the ocshareexternal database table.
- 5.3 App passwords were allowed to bypass password confirmation on sensitive endpoints.
- 4.6 The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though…
- 4.6 A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for…
- 4.3 A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not…
- 4.3 When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member…
- 3.5 A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
- 3.5 A public shared collective always allowed recipients of the link to create pages.
- 3.3 The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that nextcloud is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Red Hat Google Microsoft Apple Linux Apache Software Foundation zephyrproject n/a Oracle Corporation Unknown Hewlett Packard Enterprise (HPE) Eclipse Foundation Tanium FreeRDP IBM Samsung Semiconductor Dell SuiteCRM MONGODB kyverno vercel vim Hitachi jpadilla