# nextcloud security-advisories. Every CVE that names nextcloud security-advisories among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Webauthn tokens not removed after user has been deleted](https://agentprime.io/advisories/CVE-2021-32726.md) `CVE-2021-32726` · CVE record: nextcloud security-advisories · CVSS 7.1 High · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-708 - [Default share permissions not respected for federated reshares](https://agentprime.io/advisories/CVE-2021-32725.md) `CVE-2021-32725` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-277 - [Bypass of image blocking in Nextcloud Mail](https://agentprime.io/advisories/CVE-2021-32707.md) `CVE-2021-32707` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: Information disclosure, CWE-20 - [Nextcloud Talk not properly disassociating users from chats after account deletion](https://agentprime.io/advisories/CVE-2021-32689.md) `CVE-2021-32689` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 12 Jul 2021 · Tags: Information disclosure, CWE-708 - [Lack of ratelimit on public DAV endpoint](https://agentprime.io/advisories/CVE-2021-32705.md) `CVE-2021-32705` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-799 - [Lack of ratelimit on shareinfo endpoint](https://agentprime.io/advisories/CVE-2021-32703.md) `CVE-2021-32703` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-799 - [Application specific tokens can change their own scope](https://agentprime.io/advisories/CVE-2021-32688.md) `CVE-2021-32688` · CVE record: nextcloud security-advisories · CVSS 8.8 High · Not analysed yet · Published 12 Jul 2021 · Tags: Broken access control - [Audit log is not properly logging unsetting of share expiration date](https://agentprime.io/advisories/CVE-2021-32680.md) `CVE-2021-32680` · CVE record: nextcloud security-advisories · CVSS 3.3 Low · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-778 - [Filenames not escaped by default in controllers using DownloadResponse](https://agentprime.io/advisories/CVE-2021-32679.md) `CVE-2021-32679` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-116 - [Ratelimit not applied on OCS API responses](https://agentprime.io/advisories/CVE-2021-32678.md) `CVE-2021-32678` · CVE record: nextcloud security-advisories · CVSS 3.7 Low · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-799 - [Malicious Android application can crash the Nextcloud Android Client](https://agentprime.io/advisories/CVE-2021-32694.md) `CVE-2021-32694` · CVE record: nextcloud security-advisories · CVSS 4.1 Medium · Not analysed yet · Published 17 Jun 2021 · Tags: CWE-248 - [Malicious Android app could access Shared Preferences of the Nextcloud Android client](https://agentprime.io/advisories/CVE-2021-32695.md) `CVE-2021-32695` · CVE record: nextcloud security-advisories · CVSS 3.9 Low · Not analysed yet · Published 17 Jun 2021 · Tags: Information disclosure - [Session Fixation in Nextcloud Talk](https://agentprime.io/advisories/CVE-2021-32676.md) `CVE-2021-32676` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2021 · Tags: Authentication bypass - [Sensitive data may not be removed from storage on account removal](https://agentprime.io/advisories/CVE-2021-32658.md) `CVE-2021-32658` · CVE record: nextcloud security-advisories · CVSS 4.7 Medium · Not analysed yet · Published 8 Jun 2021 · Tags: Information disclosure - [Malicious user could break user administration page](https://agentprime.io/advisories/CVE-2021-32657.md) `CVE-2021-32657` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 1 Jun 2021 · Tags: Denial of service - [Trusted servers exchange can be triggered by attacker](https://agentprime.io/advisories/CVE-2021-32656.md) `CVE-2021-32656` · CVE record: nextcloud security-advisories · CVSS 8.6 High · Not analysed yet · Published 1 Jun 2021 · Tags: Broken access control - [Files Drop public link can be added as federated share](https://agentprime.io/advisories/CVE-2021-32655.md) `CVE-2021-32655` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 1 Jun 2021 · Tags: CWE-241 - [Attacker can obtain write access to any federated share/public link](https://agentprime.io/advisories/CVE-2021-32654.md) `CVE-2021-32654` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 1 Jun 2021 · Tags: Broken access control - [Default settings leak federated cloud ID to lookup server of all users](https://agentprime.io/advisories/CVE-2021-32653.md) `CVE-2021-32653` · CVE record: nextcloud security-advisories · CVSS 2.7 Low · Not analysed yet · Published 1 Jun 2021 · Tags: Information disclosure - [Missing permission check on email metadata retrieval](https://agentprime.io/advisories/CVE-2021-32652.md) `CVE-2021-32652` · CVE record: nextcloud security-advisories · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2021 · Tags: Broken access control Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .