nextcloud has 41 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 18 in the last 90 days against 10 in the 90 before. The busiest recent month was December 2025 with 13. The median CVSS is 4.3 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-284 (11) and CWE-639 (8). Most affected products: Tables (8), Server (7), nextcloud_server (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —
- Last 90 days
- 18 prev 10
Weakness classes
Products
- Tables 8
- Server 7
- nextcloud_server 5
- Deck 3
- Approval 2
- Collectives 2
Worst active — by depth score
CVE-2026-77165Medium· 6.5File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.48CVE-2026-45545High· 8.2Nextcloud is an open source content collaboration platform45CVE-2026-77167High· 7.5Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table41CVE-2026-45722High· 7.1Nextcloud is an open source content collaboration platform39CVE-2026-45810Medium· 6.8Nextcloud is an open source content collaboration platform37
nextcloud vulnerabilities
CVEs affecting nextcloud, newest first. Open any entry for full detail, references, and exploit status.
41 CVEsRSS
CVE-2025-66556Low· 3.5Nextcloud talk is a video & audio conferencing app for Nextcloud
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. Thi…
CVE-2025-66554Low· 3.5Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS…
CVE-2025-66553Medium· 4.3Nextcloud Tables allows you to create your own tables with individual columns
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a reques…
CVE-2025-66549Low· 2.4Nextcloud Desktop is the desktop sync client for Nextcloud
Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for ad…
CVE-2025-66548Low· 3.3Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tric…
CVE-2025-66545Low· 3.5Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team
Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash b…
CVE-2025-66515Low· 2.7The Nextcloud Approval app allows approval or disapproval of files in the sidebar
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access…
CVE-2025-66514Low· 3.5Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript wa…
CVE-2025-66513Medium· 4.3Nextcloud Tables allows you to create your own tables with individual columns
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited…
CVE-2025-66557Medium· 5.4Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permissi…
CVE-2025-66551Medium· 6.3Nextcloud Tables allows you to create your own tables with individual columns
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 …