Nextcloud Nextcloud Server vulnerabilities
189 published vulnerabilities in Nextcloud Nextcloud Server. The most were published in 2023 (43), and 8 so far in 2026.
Nextcloud Nextcloud Server vulnerabilities by year
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Nextcloud Nextcloud Server vulnerabilities
- CVE-2021-22915 Security feature bypass in Nextcloud Server
- CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server
- CVE-2023-26482 Scope of workflow operations is not validated in nextcloud server
- CVE-2021-32688 Application specific tokens can change their own scope
- CVE-2018-3775 Auth bypass in Nextcloud Server
- CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected
- CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended
- CVE-2021-32656 Trusted servers exchange can be triggered by attacker
- CVE-2023-48239 Nextcloud Server users can make external storage mount points inaccessible for other users
- CVE-2023-35928 Nextcloud user scoped external storage can be used to gather credentials of other users
- CVE-2026-45281 Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
- CVE-2024-37882 Nextcloud Server can reshare read&share only folder with more permissions
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.