Known vulnerabilities in desktop

Vendor: Nextcloud
Software: desktop
Software CPE: cpe:2.3:a:nextcloud:desktop:*:*:*:*:*:*:*:*
Total vulnerabilities: 22
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting desktop desktop is affected by 22 known vulnerabilities: 2 high, 4 medium, 16 low Critical High Medium Low

Vulnerabilities (22)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU119264 - Information Exposure Through an Error Message
CVE-2025-66549
CWE-209 Low
No
No
3.16.5 08.12.2025 SB2025120822
#VU100604 - Improper Certificate Validation
CVE-2024-52510
CWE-295 Low
No
No
3.14.2 19.11.2024 SB2024111964
#VU100602 - Insecure inherited permissions
CVE-2024-46958
CWE-277 Low
No
No
3.13.4 19.11.2024 SB2024111963
#VU92185 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-37885
CWE-94 Low
No
No
3.12.0 17.06.2024 SB2024061723
#VU74597 - Improper Verification of Cryptographic Signature
CVE-2023-29000
CWE-347 Low
No
No
3.7.0 07.04.2023 SB2023040722
#VU71820 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-23942
CWE-79 Low
No
No
3.6.3 06.02.2023 SB2023020642
#VU70792 - Cross-Site Request Forgery (CSRF)
CVE-2023-22472
CWE-352 Low
No
No
3.6.2 09.01.2023 SB2023010906
#VU69628 - Improper Certificate Validation
CVE-2022-39334
CWE-295 Low
No
No
3.6.1 28.11.2022 SB2022112806
#VU69626 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-39333
CWE-79 Low
No
No
3.6.1 28.11.2022 SB2022112806
#VU69625 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-39332
CWE-79 Low
No
No
3.6.1 28.11.2022 SB2022112806
#VU69624 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-39331
CWE-79 Low
No
No
3.6.1 28.11.2022 SB2022112806
#VU69267 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-41882
CWE-94 Medium
No
No
3.6.1 14.11.2022 SB2022111407
#VU55977 - Improper Certificate Validation
CVE-2021-32728
CWE-295 Medium
No
No
3.3.0 19.08.2021 SB2021081902
#VU55976 - Untrusted Search Path
CVE-2021-37617
CWE-426 High
No
No
3.3.0 19.08.2021 SB2021081902
#VU52064 - Cleartext Storage of Sensitive Information
CVE-2020-8225
CWE-312 Low
No
No
2.6.5 13.04.2021 SB2020081034
#VU52063 - Improper input validation
CVE-2021-22879
CWE-20 High
No
No
3.1.3 13.04.2021 SB2021041304
SB2021052712
SB2021041533
and 1 more
#VU46082 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2020-8227
CWE-22 Medium
No
No
2.6.5 21.08.2020 SB2020082723
SB2020091501
#VU46083 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-8189
CWE-79 Low
No
No
2.6.5 21.08.2020 SB2020082723
SB2020091501
#VU46717 - Protection Mechanism Failure
CVE-2020-8230
CWE-693 Low
No
No
2.6.5 17.08.2020 SB2020081034
#VU46718 - Missing release of memory after effective lifetime
CVE-2020-8229
CWE-401 Low
No
No
2.6.5 10.08.2020 SB2020081034


Showing elements 1 - 20 out of 22