Nextcloud Calendar

10 CVEs affecting Nextcloud Calendar. Latest disclosed: 2026-06-01. Critical: 0, High: 0.

Top CVEs affecting Nextcloud Calendar
CVESeverityScorePublishedSummary
CVE-2025-66550Medium5.72025-12-05Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that li…
CVE-2022-24838Medium5.32022-04-11Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special ch…
CVE-2025-66511Medium4.82025-12-05Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function…
CVE-2018-3763Medium4.82018-07-05In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-inte…
CVE-2024-37316Medium4.62024-06-14Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for pa…
CVE-2026-45286Medium4.32026-06-01Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumera…
CVE-2023-45150Medium4.32023-10-16Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any len…
CVE-2023-48308Low3.52023-12-22Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while…
CVE-2025-66546Low3.32025-12-05Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential I…
CVE-2023-33183Low2.62023-05-30Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server i…