Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,111All CVEsplus 18,873 rejected
- 791Last 24 hours3,265 in the last 7 days
- 17,394Last 30 days1,568 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 28 | 12 | 0 | 45 | 306 |
| 2025 | 0 | 0 | 16 | 10 | 0 | 26 | 261 |
| 2024 | 2 | 3 | 16 | 15 | 1 | 37 | 235 |
| 2023 | 1 | 12 | 41 | 25 | 1 | 80 | 198 |
| 2022 | 0 | 2 | 24 | 24 | 0 | 50 | 118 |
| 2021 | 1 | 12 | 24 | 10 | 0 | 47 | 68 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 21 |
| 2019 | 0 | 0 | 2 | 0 | 0 | 2 | 21 |
| 2018 | 0 | 1 | 6 | 0 | 0 | 7 | 19 |
| 2017 | 0 | 0 | 10 | 2 | 0 | 12 | 12 |
| Title | ||
|---|---|---|
| CVE-2026-82984 | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the…Nextcloud · Server | Medium4.3 |
| CVE-2026-77167 | Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there…Nextcloud · server | High7.5 |
| CVE-2026-77173 | A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as…Nextcloud · Files Confidential | Medium4.3 |
| CVE-2026-67400 | A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.Nextcloud · Richdocuments | Low3.5 |
| CVE-2026-77171 | A public shared collective always allowed recipients of the link to create pages.Nextcloud · Collectives | Low3.5 |
| CVE-2026-77172 | App passwords were allowed to bypass password confirmation on sensitive endpoints.Nextcloud · Server | Medium5.3 |
| CVE-2026-87897 | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low…Nextcloud · whiteboard | Medium4.6 |
| CVE-2026-82983 | The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the…Nextcloud · Tables | Low3.3 |
| CVE-2026-82986 | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have…Nextcloud · Tables | Medium4.6 |
| CVE-2026-77165 | File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.Nextcloud · Server | Medium6.5 |
| CVE-2026-77166 | The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes…Nextcloud · Collectives | Low2.4 |
| CVE-2026-68493 | After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.Nextcloud · Server | Low3.1 |
| CVE-2026-82985 | The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album,…Nextcloud · Server | Medium6.5 |
| CVE-2026-77164 | Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly…Nextcloud · Server | Medium6.2 |
| CVE-2026-77170 | The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has…Nextcloud · Deck | Medium4.3 |
| CVE-2026-82982 | The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting…Nextcloud · Approval | Medium4.3 |
| CVE-2026-77169 | A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators…Nextcloud · Team Folders | Medium6.5 |
| CVE-2026-82980 | Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the…Nextcloud · Files Lock | Medium6.3 |
| CVE-2026-45810 | Nextcloud: Propfind requests for file comments allowed to load comments for other filesnextcloud · security-advisories | Medium6.8 |
| CVE-2026-45722 | Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Viewsnextcloud · security-advisories | High7.1 |
| CVE-2026-45691 | Nextcloud: Bypass of second factor authentication on DAV endpointsnextcloud · security-advisories | Medium5.9 |
| CVE-2026-45690 | Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replaynextcloud · security-advisories | Medium5.9 |
| CVE-2026-45545 | Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Executionnextcloud · security-advisories | High8.2 |
| CVE-2026-45544 | Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewServicenextcloud · security-advisories | Medium4.3 |
| CVE-2026-45543 | Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files sharenextcloud · security-advisories | Medium5.3 |
| CVE-2026-45286 | Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpointnextcloud · security-advisories | Medium4.3 |
| CVE-2026-45284 | Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticatenextcloud · security-advisories | Medium4.6 |
| CVE-2026-45285 | Nextcloud: Hidden Public Link creation when sharing to a Team External Membernextcloud · security-advisories | Medium6.4 |
| CVE-2026-45283 | Nextcloud: Files Lock app allows users to lock and unlock files of other usersnextcloud · security-advisories | Medium6.3 |
| CVE-2026-45282 | Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file accessnextcloud · security-advisories | Medium6.5 |
| CVE-2026-45281 | Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Updatenextcloud · security-advisories | High8.1 |
| CVE-2026-45279 | Nextcloud: Limited path traversal via template API if using `{lang}` in confignextcloud · security-advisories | Medium4.4 |
| CVE-2026-45278 | Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypassnextcloud · security-advisories | Low3.3 |
| CVE-2026-45277 | Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associationsnextcloud · security-advisories | Low3.3 |
| CVE-2026-45275 | Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approversnextcloud · security-advisories | Medium6.5 |
| CVE-2026-45267 | Nextcloud: Missing permission check for from submissionsnextcloud · security-advisories | Medium6.5 |
| CVE-2026-45266 | Nextcloud: Unauthorized force-mute from missing permission check when using internal signalingnextcloud · security-advisories | Low3.5 |
| CVE-2026-45159 | Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share ownernextcloud · security-advisories | Low3.5 |
| CVE-2026-45157 | Nextcloud: Valid share tokens allow to access tempory upload files of share ownernextcloud · security-advisories | Medium6.3 |
| CVE-2026-45156 | Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDCnextcloud · security-advisories | High8.1 |
| CVE-2026-45155 | Nextcloud: Private circle can be added to another circle via APInextcloud · security-advisories | Low2.6 |
| CVE-2026-45154 | Nextcloud: Improper Access Control in Collectivesnextcloud · security-advisories | Low2.6 |
| CVE-2026-45153 | Nextcloud: PIN bypass in PassCodeActivity via back buttonnextcloud · security-advisories | Medium4.6 |
| CVE-2026-45264 | Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renamesnextcloud · security-advisories | Medium4.3 |
| CVE-2026-44515 | Nextcloud News: Authenticated blind SSRF via feed URLnextcloud · news | Low2.3 |
| CVE-2025-66558 | Nextcloud Twofactor WebAuthn app was updated based on public keynextcloud · security-advisories | Low3.1 |
| CVE-2025-66556 | Nextcloud talk allows participants to blindly delete poll drafts of other users by IDnextcloud · security-advisories | Low3.5 |
| CVE-2025-66554 | Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title fieldnextcloud · security-advisories | Low3.5 |
| CVE-2025-66549 | Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directorynextcloud · security-advisories | Low2.4 |
| CVE-2025-66545 | Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash binnextcloud · security-advisories | Low3.5 |