Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal

Windmill 1.603.3 contains a path traversal caused by unsanitized filename parameter in getlogfile endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication. id: CVE-2026-29059 info: name: Windmill/Nextcloud Flow 1.603.3 - Unauthenticated Pa...

NcStatusCheck

NcStatusCheck Centralized monitoring for multiple Nextcloud instances NcStatusCheck is a monitoring tool that lets you track the health of multiple Nextcloud servers from a single web interface: Nextcloud and PHP versions against their security floor, branch end of life, reachability, configurati...

nextcloud_android

Nextcloud Android app Codacy Badge The Android client forNextcloud. Easily work with your data on your Nextcloud. How to contribute If you want to contribute to Nextcloud, you are very welcome: on our IRC channels and on freenode our forum at https://help.nextcloud.com for translations of the app...

mailinabox

Mail-in-a-Box By @JoshData and contributors. Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box. Please seehttps://mailinabox.email for the project's website and setup guide! Our goals are to...

security-advisories

Security advisories This repository is the authoritative source for security advisories from the Nextcloud project: Advisories after May 2021 are published using GitHub's Security Advisory section Advisories before May 2021 can be found in the archived old/ folder as JSON files...

CVE-2026-45156-POC

Hacker Matrix Glitch 🚨 CVE-2026-45156 🚨 Nextcloud useroidc ID4me JWT Signature Bypass Fully Automated Proof of Concept PoC Exploit for Admin Takeover. 📖 The Story Behind every CVE, there's a story. This one was found at 2 AM on a cold winter night, fueled by a breakup mashup on loop. Read the ful...

Fedora 44 : nextcloud (2026-1ffca57dbf)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1ffca57dbf advisory. 35.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora 45 : nextcloud (2026-72dc7f85d2)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-72dc7f85d2 advisory. 35.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora 43 : nextcloud (2026-b6b68838b0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b6b68838b0 advisory. 35.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

nextcloud-ldap-put-isadmin

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-ldap-put-isadmin Write-up: https://abraxaslabs.tech/research/nextcloud-ldap-put-isadmin nextcloud-ldap-put-isadmin Nextcloud Server 35.0.0 - Nextcloud GmbH PUT /cloud/users/id lets a delegated Users admin...

nextcloud-federated-ocm-token

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-federated-ocm-token Write-up: https://abraxaslabs.tech/research/nextcloud-federated-ocm-token nextcloud-federated-ocm-token Nextcloud Server 35.0.0 - Nextcloud GmbH A federated share secret is minted as an...

CVE-2026-52782

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-52782 Write-up: https://abraxaslabs.tech/research/CVE-2026-52782 CVE-2026-52782 OpenProject 17.3.2 - OpenProject GmbH I am @abraxasnull. Loopback lab. The client is CVE-2026-52782-Abraxas-Labs.py. IDOR on...

PoC---CVE-2023-26482-RCE-LAB-Nextcloud

Next cloud Proof of Concept & Analysis Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...

nextcloud-calendar-sharee-publish

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-calendar-sharee-publish Write-up: https://abraxaslabs.tech/research/nextcloud-calendar-sharee-publish nextcloud-calendar-sharee-publish Nextcloud Server 35.0.0 - Nextcloud GmbH CalDAV PublishPlugin only...

CVE-2026-82984

A flaw was found in Nextcloud Server. When a team is configured as visible to all users, the web interface restricts access to non-members, but the underlying resources application programming interface API endpoint fails to enforce proper access controls. An authenticated user who is not a team...

CVE-2026-77172

A flaw was found in Nextcloud Server. Application passwords were permitted to bypass password confirmation on sensitive endpoints. An attacker with access to a valid application password could perform operations on sensitive endpoints that normally require re-confirmation of the account password,...

nextcloud-webhook-tokenneeded

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-webhook-tokenneeded Write-up: https://abraxaslabs.tech/research/nextcloud-webhook-tokenneeded nextcloud-webhook-tokenneeded Nextcloud Server 35.0.0 - Nextcloud GmbH WebhooksController::create nulls...

CVE-2024-52510

Nextcloud X-E2EE-SIGNATURE Bypass POC Summary During normal operation of Nextcloud's E2EEv2 protocol, clients cryptographically sign folder-metadata before uploading to the server. This ensures the metadata has not been tampered with when it is re-fetched for the purposes of file-sharing or synci...

CLEANSTART-2024-WQ64584 Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud

Security vulnerability affects the nextcloud-client package. Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud...

CLEANSTART-2024-CR33815 Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server

Security vulnerability affects the nextcloud-client package. The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server...