nextcloud vulnerabilities

CVEs per yearBy the year they were published

1. 20186
2. 201813
3. 20192
4. 202243
5. 202254
6. 202380
7. 202437
8. 202526
9. 202645

Newest CVEs

• CVE-2026-82984

  When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the…

  Nextcloud · Server

  Medium4.3
• CVE-2026-77167

  Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there…

  Nextcloud · server

  High7.5
• CVE-2026-77173

  A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as…

  Nextcloud · Files Confidential

  Medium4.3
• CVE-2026-67400

  A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

  Nextcloud · Richdocuments

  Low3.5
• CVE-2026-77171

  A public shared collective always allowed recipients of the link to create pages.

  Nextcloud · Collectives

  Low3.5
• CVE-2026-77172

  App passwords were allowed to bypass password confirmation on sensitive endpoints.

  Nextcloud · Server

  Medium5.3
• CVE-2026-87897

  A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low…

  Nextcloud · whiteboard

  Medium4.6
• CVE-2026-82983

  The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the…

  Nextcloud · Tables

  Low3.3
• CVE-2026-82986

  The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have…

  Nextcloud · Tables

  Medium4.6
• CVE-2026-77165

  File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

  Nextcloud · Server

  Medium6.5