Vulnerabilidades em Nextcloud
306 resultadosAnálise Vexday
Nextcloud possui 20 vulnerabilidades registradas na base, todas de severidade moderada ou inferior, com destaque para falhas de Cross-Site Scripting (CWE-79). Nenhuma vulnerabilidade está sob ataque ativo conhecido, e não há publicações recentes nos últimos 90 dias, indicando um panorama de risco estável e sem pressão imediata.
CVE-2023-28646MEDIUMApp lockout in nextcloud Android app can be bypassed via thirdparty appsEPSS 0.2%CVE-2026-45264MEDIUMNextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File RenamesEPSS 0.2%CVE-2026-68493LOWAfter guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they arEPSS 0.2%CVE-2026-45544MEDIUMNextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewServiceEPSS 0.2%CVE-2023-22472MEDIUMNextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious linkEPSS 0.2%CVE-2026-77173MEDIUMA user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not bEPSS 0.2%CVE-2026-45283MEDIUMNextcloud: Files Lock app allows users to lock and unlock files of other usersEPSS 0.2%CVE-2023-32318HIGHUser session not correctly destroyed on logoutEPSS 0.2%CVE-2026-45159LOWNextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share ownerEPSS 0.2%CVE-2026-45266LOWNextcloud: Unauthorized force-mute from missing permission check when using internal signalingEPSS 0.2%CVE-2026-87897MEDIUMA SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for anotEPSS 0.2%CVE-2022-39334LOWnextcloudcmd incorrectly trusts bad TLS certificatesEPSS 0.2%CVE-2026-45155LOWNextcloud: Private circle can be added to another circle via APIEPSS 0.2%CVE-2026-45284MEDIUMNextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticateEPSS 0.2%CVE-2026-45154LOWNextcloud: Improper Access Control in CollectivesEPSS 0.2%CVE-2026-77164MEDIUMCircles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, EPSS 0.2%CVE-2026-44515LOWNextcloud News: Authenticated blind SSRF via feed URLEPSS 0.2%CVE-2025-47792MEDIUMNextcloud Desktop 3rdparty applications can create share links via socket APIEPSS 0.2%CVE-2026-67400LOWA missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.EPSS 0.2%CVE-2026-77171LOWA public shared collective always allowed recipients of the link to create pages.EPSS 0.2%