Known vulnerabilities in nextcloud
Vendor:
Fedoraproject
Software:
nextcloud
Software CPE:
cpe:2.3:o:fedoraproject:nextcloud:*:*:*:*:*:fedora:*:*
Website:
https://getfedora.org/
Total vulnerabilities:
36
Public exploits:
2
Known exploited (KEV):
0
Breakdown by Severity Chart
34.0.4-1.el10_2
34.0.4-1.el10_4
34.0.4-1.fc43
34.0.4-1.fc44
34.0.4-1.fc45
34.0.3-1.el10_2
34.0.3-1.fc44
34.0.3-1.el10_3
34.0.2-1.fc43
34.0.2-1.el10_2
34.0.2-1.el10_3
34.0.2-1.fc44
33.0.6-1.el10_2
33.0.6-1.el10_3
33.0.6-1.fc43
33.0.6-1.fc44
33.0.5-1.el10_2
33.0.5-1.el10_3
33.0.5-1.fc43
33.0.5-1.fc44
33.0.4-1.el10_2
33.0.4-1.fc43
33.0.4-1.el10_3
33.0.4-1.fc44
33.0.3-1.fc42
33.0.3-1.el10_1
33.0.3-1.el10_2
33.0.3-1.el10_3
33.0.3-1.fc43
33.0.3-1.fc44
33.0.1-1.fc42
33.0.1-1.el10_1
32.0.6-1.el10_2
32.0.6-1.fc42
32.0.6-1.el10_1
32.0.6-1.fc44
32.0.6-1.fc43
31.0.9-1.el10_1
31.0.9-1.el10_2
31.0.9-1.fc41
31.0.9-1.fc42
31.0.9-1.fc43
31.0.9-1.fc44
31.0.5-1.fc41
31.0.5-1.fc42
31.0.5-1.fc43
19.0.3-1.fc33
18.0.9-1.fc32
29.0.16-1.el9
31.0.2-2.fc40
31.0.2-1.fc41
31.0.2-1.fc42
31.0.2-1.fc43
29.0.12-2.el9
31.0.0-1.fc42
31.0.0-1.fc43
25.0.1-1.fc35
25.0.1-1.fc36
25.0.1-1.fc37
nextcloud_stable-3420210712183013.058368ca
nextcloud_21-3420210712182939.058368ca
nextcloud_stable-3320210712183013.601d93de
nextcloud_21-3320210712182939.601d93de
nextcloud_stable-820210712183013.9edba152
nextcloud_21-820210712182939.9edba152
nextcloud_20-3320210712182853.601d93de
nextcloud_20-3420210712182853.058368ca
nextcloud_20-820210712182853.9edba152
nextcloud_19-3420210712182738.058368ca
nextcloud_19-3320210712182738.601d93de
nextcloud_19-820210712182738.9edba152
20.0.11-1.fc34
19.0.13-1.fc33
nextcloud_stable-820210630133028.9edba152
nextcloud_21-820210630133336.9edba152
nextcloud_stable-3420210630133028.058368ca
nextcloud_21-3420210630133336.058368ca
nextcloud_stable-3320210630133028.601d93de
nextcloud_21-3320210630133336.601d93de
nextcloud_20-820210630133442.9edba152
20.0.10-1.fc34
nextcloud_20-3320210630133442.601d93de
nextcloud_20-3420210630133442.058368ca
nextcloud_19-820210630133545.9edba152
nextcloud_19-3420210630133545.058368ca
nextcloud_19-3320210630133545.601d93de
19.0.12-1.fc33
29.0.6-2.fc40
29.0.6-1.fc41
29.0.6-1.el9
29.0.6-2.fc39
29.0.5-3.el9
29.0.5-4.fc39
29.0.5-4.fc40
29.0.5-3.fc41
29.0.5-3.fc42
28.0.5-2.fc39
28.0.5-2.fc40
Vulnerabilities (36)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU146786 - Uncaught Exception CVE-2026-82417 |
CWE-248 | Medium | 34.0.4-1.el10_2, 34.0.4-1.el10_4, 34.0.4-1.fc43, 34.0.4-1.fc44, 34.0.4-1.fc45 | 02.09.2026 |
SB2026090291 SB2026092001 SB2026092002 and 5 more |
||
| #VU146785 - Allocation of Resources Without Limits or Throttling CVE-2026-82562 |
CWE-770 | Low | 34.0.4-1.el10_2, 34.0.4-1.el10_4, 34.0.4-1.fc43, 34.0.4-1.fc44, 34.0.4-1.fc45 | 02.09.2026 |
SB2026090291 SB2026092001 SB2026092002 and 5 more |
||
| #VU140936 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\') CVE-2026-71438 |
CWE-1321 | Medium | 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44 | 04.08.2026 |
SB2026080474 SB2026091499 SB20260914100 and 1 more |
||
| #VU140932 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\') CVE-2026-71437 |
CWE-1321 | High | 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44 | 04.08.2026 |
SB2026080474 SB2026091499 SB20260914100 and 1 more |
||
| #VU140846 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-75838 |
CWE-79 | Low | 34.0.4-1.el10_2, 34.0.4-1.el10_4, 34.0.4-1.fc43, 34.0.4-1.fc44, 34.0.4-1.fc45 | 04.08.2026 |
SB2026080415 SB2026092001 SB2026092002 and 6 more |
||
| #VU140088 - Incorrect Behavior Order: Validate Before Canonicalize CVE-2026-59883 |
CWE-180 | Medium | 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44 | 30.07.2026 |
SB2026073019 SB2026091499 SB20260914100 and 1 more |
||
| #VU137374 - Improper Access Control CVE-2026-66010 |
CWE-284 | Medium | 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44 | 13.07.2026 |
SB2026071311 SB2026091499 SB20260914100 and 4 more |
||
| #VU137372 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-65900 |
CWE-79 | Medium | 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44 | 13.07.2026 |
SB2026071309 SB2026091499 SB20260914100 and 1 more |
||
| #VU136912 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\') CVE-2026-67316 |
CWE-1321 | Low | 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44 | 06.07.2026 |
SB2026070641 SB2026091499 SB20260914100 and 5 more |
||
| #VU132289 - Resource exhaustion CVE-2026-48988 |
CWE-400 | Medium | 34.0.4-1.el10_2, 34.0.4-1.el10_4, 34.0.4-1.fc43, 34.0.4-1.fc44, 34.0.4-1.fc45 | 25.05.2026 |
SB2026052543 SB2026092001 SB2026092002 and 3 more |
||
| #VU131921 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CVE-2026-40175 |
CWE-113 | Medium | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 20.05.2026 |
SB2026052045 SB2026052051 SB2026052052 and 23 more |
||
| #VU127606 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CVE-2026-42035 |
CWE-113 | Medium | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 24.04.2026 |
SB20260424169 SB2026061912 SB2026061913 and 18 more |
||
| #VU126319 - Improper Access Control CVE-2026-65903 |
CWE-284 | Medium | 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44 | 16.04.2026 |
SB2026041630 SB2026091499 SB20260914100 and 1 more |
||
| #VU125803 - Improper Control of Generation of Code ('Code Injection') CVE-2026-4800 |
CWE-94 | High | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 10.04.2026 |
SB2026041094 SB20260410101 SB20260410102 and 65 more |
||
| #VU125780 - Information Exposure Through Timing Discrepancy CVE-2026-40194 |
CWE-208 | Low | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 10.04.2026 |
SB2026041033 SB2026061912 SB2026061913 and 3 more |
||
| #VU125750 - Server-Side Request Forgery (SSRF) CVE-2025-62718 |
CWE-918 | High | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 10.04.2026 |
SB2026041001 SB2026050419 SB2026050715 and 33 more |
||
| #VU125102 - Resource exhaustion CVE-2026-39865 |
CWE-400 | Medium | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 08.04.2026 |
SB2026040829 SB20260410109 SB20260410110 and 14 more |
||
| #VU124844 - Improper Check for Unusual or Exceptional Conditions CVE-2026-33939 |
CWE-754 | Medium | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 02.04.2026 |
SB2026040261 SB2026042720 SB2026061912 and 6 more |
||
| #VU124843 - Improper Control of Generation of Code ('Code Injection') CVE-2026-33941 |
CWE-94 | High | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 02.04.2026 |
SB2026040261 SB2026042720 SB2026061912 and 6 more |
||
| #VU124840 - Improper Control of Generation of Code ('Code Injection') CVE-2026-33940 |
CWE-94 | High | 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44 | 02.04.2026 |
SB2026040261 SB2026042720 SB2026061912 and 6 more |
Showing elements 1 - 20 out of 36