# Nextcloud Nextcloud Server


- [CVE-2021-22915](https://insights.sbomify.com/CVE-2021-22915/): Security feature bypass in Nextcloud Server (critical 9.8)
- [CVE-2021-32802](https://insights.sbomify.com/CVE-2021-32802/): Preview generation used third-party library not suited for user-generated content in Nextcloud server (critical 9.3)
- [CVE-2023-26482](https://insights.sbomify.com/CVE-2023-26482/): Scope of workflow operations is not validated in nextcloud server (critical 9.1)
- [CVE-2021-32688](https://insights.sbomify.com/CVE-2021-32688/): Application specific tokens can change their own scope (high 8.8)
- [CVE-2018-3775](https://insights.sbomify.com/CVE-2018-3775/): Auth bypass in Nextcloud Server (high 8.8)
- [CVE-2023-35172](https://insights.sbomify.com/CVE-2023-35172/): Nextcloud Server password reset endpoint is not brute force protected (high 8.7)
- [CVE-2023-32320](https://insights.sbomify.com/CVE-2023-32320/): Nextcloud Server's brute force protection allows someone to send more requests than intended (high 8.7)
- [CVE-2021-32656](https://insights.sbomify.com/CVE-2021-32656/): Trusted servers exchange can be triggered by attacker (high 8.6)
- [CVE-2023-48239](https://insights.sbomify.com/CVE-2023-48239/): Nextcloud Server users can make external storage mount points inaccessible for other users (high 8.5)
- [CVE-2023-35928](https://insights.sbomify.com/CVE-2023-35928/): Nextcloud user scoped external storage can be used to gather credentials of other users (high 8.5)
- [CVE-2026-45281](https://insights.sbomify.com/CVE-2026-45281/): Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update (high 8.1)
- [CVE-2024-37882](https://insights.sbomify.com/CVE-2024-37882/): Nextcloud Server can reshare read&share only folder with more permissions (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/products/nextcloud/nextcloud-server/