Vulnerabilities in nextcloud

288 results
Vexday analysis

O ecossistema Nextcloud acumula 266 CVEs catalogadas, com volume de novas vulnerabilidades ainda ativo — 27 surgiram nos últimos 90 dias —, mas apresenta taxa de exploração ativa abaixo da média geral do catálogo, sem registros no CISA KEV. O tipo de falha predominante é CWE-284 (controle de acesso inadequado), o que indica fragilidades estruturais na gestão de permissões que tendem a ampliar a superfície de ataque em ambientes colaborativos. A CVE mais relevante no momento é CVE-2022-24838, com escore EPSS de 0,3155 — o mais alto observado no conjunto —, sinalizando probabilidade não negligenciável de exploração e merecendo atenção prioritária em qualquer plano de remediação. A existência de 2 CVEs com PoC pública, combinada a 4 falhas críticas, reforça a necessidade de monitoramento contínuo mesmo em um cenário onde a exploração confirmada ainda é ausente.

CVE-2024-52516LOWNextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of themEPSS 0.4%CVE-2024-52512LOWNextcloud User OIDC has an open redirection when logging in with User OIDCEPSS 0.4%CVE-2024-37314LOWNextcloud Photos' shared albums have no restriction on photo removalEPSS 0.4%CVE-2024-52507LOWShare information of the Nextcloud Tables app is not limited to affected usersEPSS 0.4%CVE-2025-47794LOWNextcloud Server vulnerable to insecure temporary file creation, race with write access and permissionEPSS 0.4%CVE-2024-37313HIGHNextcloud server allows the by-pass the second factorEPSS 0.4%CVE-2026-45279MEDIUMNextcloud: Limited path traversal via template API if using `{lang}` in configEPSS 0.4%CVE-2023-29000MEDIUMNextcloud Desktop client does not verify received singed certificate in end-to-end encryptionEPSS 0.4%CVE-2023-45150MEDIUMInviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsiveEPSS 0.4%CVE-2024-52521LOWNextcloud Server has a potential hash collision for background jobs could skip queuing themEPSS 0.4%CVE-2024-37887LOWNextcloud Server's events information leaked with shared calendars on recurrence exceptionsEPSS 0.4%CVE-2024-37883MEDIUMNextcloud Deck can access comments and attachments of deleted cardsEPSS 0.4%CVE-2022-24886LOWExposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.clientEPSS 0.4%CVE-2024-37884LOWNextcloud Server's users can delete old versions of read-only shared filesEPSS 0.4%CVE-2022-35931LOWNextcloud Password Policy's generated passwords are not fully validated by HIBPValidatorEPSS 0.4%CVE-2022-29160LOWSensitive files/data exist after deletion of user account in Nextcloud AndroidEPSS 0.4%CVE-2023-39954LOWuser_oidc app stores client secret unencrypted in databaseEPSS 0.4%CVE-2024-37316MEDIUMNextcloud Calendar's event create can create attachments that link to other websitesEPSS 0.4%CVE-2026-45275MEDIUMNextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approversEPSS 0.4%CVE-2021-32680LOWAudit log is not properly logging unsetting of share expiration dateEPSS 0.4%