6215 matches found
Nextcloud: Public collectives allow to create pages
A vulnerability was discovered in the Nextcloud Collectives application that allowed non-members accessing a public collective to create new pages through the backend API, bypassing the collective-level permission settings configured to restrict editing to administrators only. The vulnerability w...
[SECURITY] Fedora 42 Update: qownnotes-26.1.7-4.fc42
QOwnNotes is the open source notepad with Markdown support and todo list mana ger for GNU/Linux, macOS and Windows, that works together with Nextcloud Notes and ownCloud Notes. You are able to write down your thoughts with QOwnNotes and edit or search for them later from your mobile device, like...
ROS-20260129-73-0050
Vulnerability in nextcloud-app-contacts related to failure to take measures to protect web page structure. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...
ROS-20260129-73-0048
Vulnerability in nextcloud-app-calendar related to improper handling of an unexpected data type. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
ROS-20260129-73-0049
Vulnerability in nextcloud-app-calendar related to the use of insufficiently randomized values. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...
ROS-20260129-73-0047
Vulnerability in nextcloud related to authorization bypass through the use of a user-controlled key. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...
ROS-20260129-73-0046
Vulnerability in nextcloud related to flaws in access to personal information. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...
ROS-20260129-73-0045
Vulnerability in nextcloud related to bugs in security settings. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
CVE-2025-66547 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2025-66552 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
[SECURITY] Fedora 43 Update: qownnotes-26.1.7-4.fc43
QOwnNotes is the open source notepad with Markdown support and todo list mana ger for GNU/Linux, macOS and Windows, that works together with Nextcloud Notes and ownCloud Notes. You are able to write down your thoughts with QOwnNotes and edit or search for them later from your mobile device, like...
Nextcloud: Missing Duplicate Check allowing Multiple Retention Rules per System Tag
A bug allowed admins to create multiple retention rules for the same tag, causing potential confusion for other admins...
Nextcloud: Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app
The timeamount parameter of the filesretention app lacked proper input validation, allowing an administrator to store an unintended long time amount as the retention period. This vulnerability could have potentially led to files never getting deleted...
Nextcloud: View-only guests could see deleted Collectives pages in the trashbin
A vulnerability was discovered where view-only guests could see deleted Collectives pages in the trashbin...
Nextcloud: IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos
Summary: An Insecure Direct Object Reference IDOR vulnerability exists in the application that allows unauthorized access to photos belonging to other users. The application does not properly validate whether the logged-in user is authorized to access a photo when accessing it via direct URL. Thi...
PT-2026-23549
Name of the Vulnerable Software and Affected Versions OpenClaw Nextcloud Talk plugin versions prior to 2026.2.6 Description The Nextcloud Talk plugin allows attackers to bypass direct message DM and room allowlists. The plugin incorrectly uses the mutable actor.name field for allowlist validation...
Nextcloud: Unauthenticated testing endpoint of notify_push expose internal IP
The testing endpoint of the notifypush component exposed internal IP addresses to unauthenticated users...
Nextcloud: Private circle can be added to another circle via API despite visibility restriction
A vulnerability was discovered where private circles could be added to other circles via the API, despite visibility restrictions...
