Nextcloud Nextcloud_server
189 CVEs affecting Nextcloud Nextcloud_server. Latest disclosed: 2026-06-01. Critical: 3, High: 28.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22915 | Critical | 9.8 | 2021-06-11 | Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations… |
CVE-2021-32802 | Critical | 9.3 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image type… |
CVE-2023-26482 | Critical | 9.0 | 2023-03-30 | Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are desig… |
CVE-2021-32688 | High | 8.8 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tok… |
CVE-2018-3775 | High | 8.8 | 2018-08-12 | Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authenticatio… |
CVE-2023-35172 | High | 8.7 | 2023-06-23 | NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 u… |
CVE-2023-32320 | High | 8.7 | 2023-06-22 | Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were exe… |
CVE-2021-32656 | High | 8.6 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2… |
CVE-2023-48239 | High | 8.5 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1… |
CVE-2023-35928 | High | 8.4 | 2023-06-23 | Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 unt… |
CVE-2026-45281 | High | 8.1 | 2026-06-01 | Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the kn… |
CVE-2024-37882 | High | 8.1 | 2024-06-14 | Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is… |
CVE-2023-39963 | High | 8.1 | 2023-08-10 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22… |
CVE-2023-32319 | High | 8.1 | 2023-05-26 | Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to b… |
CVE-2021-41177 | High | 8.1 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database ba… |
CVE-2021-32800 | High | 8.1 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus… |
CVE-2021-32654 | High | 8.1 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read… |
CVE-2020-8259 | High | 8.1 | 2020-11-16 | Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys. |
CVE-2020-8121 | High | 8.1 | 2020-02-04 | A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. |
CVE-2018-16466 | High | 8.1 | 2018-10-30 | Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens. |