agentprime: nextcloud-security-advisories

agentprime: nextcloud-security-advisoriesEvery new CVE for nextcloud-security-advisories.https://agentprime.io/CVE-2026-45810: Nextcloud: Propfind requests for file comments allowed to load comments for other fileshttps://agentprime.io/advisories/CVE-2026-45810/https://agentprime.io/advisories/CVE-2026-45810/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 17:13:21 GMTCVECVE-2026-45722: Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Viewshttps://agentprime.io/advisories/CVE-2026-45722/https://agentprime.io/advisories/CVE-2026-45722/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 17:11:15 GMTCVECVE-2026-45691: Nextcloud: Bypass of second factor authentication on DAV endpointshttps://agentprime.io/advisories/CVE-2026-45691/https://agentprime.io/advisories/CVE-2026-45691/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 17:09:48 GMTCVECVE-2026-45690: Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replayhttps://agentprime.io/advisories/CVE-2026-45690/https://agentprime.io/advisories/CVE-2026-45690/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 17:08:04 GMTCVECVE-2026-45545: Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Executionhttps://agentprime.io/advisories/CVE-2026-45545/https://agentprime.io/advisories/CVE-2026-45545/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 17:05:18 GMTCVECVE-2026-45544: Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewServicehttps://agentprime.io/advisories/CVE-2026-45544/https://agentprime.io/advisories/CVE-2026-45544/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 17:03:06 GMTCVECVE-2026-45543: Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files sharehttps://agentprime.io/advisories/CVE-2026-45543/https://agentprime.io/advisories/CVE-2026-45543/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 17:00:48 GMTCVECVE-2026-45286: Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpointhttps://agentprime.io/advisories/CVE-2026-45286/https://agentprime.io/advisories/CVE-2026-45286/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:59:36 GMTCVECVE-2026-45284: Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticatehttps://agentprime.io/advisories/CVE-2026-45284/https://agentprime.io/advisories/CVE-2026-45284/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:57:56 GMTCVECVE-2026-45285: Nextcloud: Hidden Public Link creation when sharing to a Team External Memberhttps://agentprime.io/advisories/CVE-2026-45285/https://agentprime.io/advisories/CVE-2026-45285/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:57:50 GMTCVECVE-2026-45283: Nextcloud: Files Lock app allows users to lock and unlock files of other usershttps://agentprime.io/advisories/CVE-2026-45283/https://agentprime.io/advisories/CVE-2026-45283/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:53:50 GMTCVECVE-2026-45282: Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file accesshttps://agentprime.io/advisories/CVE-2026-45282/https://agentprime.io/advisories/CVE-2026-45282/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:53:18 GMTCVECVE-2026-45281: Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Updatehttps://agentprime.io/advisories/CVE-2026-45281/https://agentprime.io/advisories/CVE-2026-45281/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:52:57 GMTCVECVE-2026-45279: Nextcloud: Limited path traversal via template API if using `{lang}` in confighttps://agentprime.io/advisories/CVE-2026-45279/https://agentprime.io/advisories/CVE-2026-45279/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:52:18 GMTCVECVE-2026-45278: Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypasshttps://agentprime.io/advisories/CVE-2026-45278/https://agentprime.io/advisories/CVE-2026-45278/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:51:55 GMTCVECVE-2026-45277: Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associationshttps://agentprime.io/advisories/CVE-2026-45277/https://agentprime.io/advisories/CVE-2026-45277/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:51:34 GMTCVECVE-2026-45275: Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvershttps://agentprime.io/advisories/CVE-2026-45275/https://agentprime.io/advisories/CVE-2026-45275/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:51:22 GMTCVECVE-2026-45267: Nextcloud: Missing permission check for from submissionshttps://agentprime.io/advisories/CVE-2026-45267/https://agentprime.io/advisories/CVE-2026-45267/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:40:18 GMTCVECVE-2026-45266: Nextcloud: Unauthorized force-mute from missing permission check when using internal signalinghttps://agentprime.io/advisories/CVE-2026-45266/https://agentprime.io/advisories/CVE-2026-45266/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:39:56 GMTCVECVE-2026-45159: Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share ownerhttps://agentprime.io/advisories/CVE-2026-45159/https://agentprime.io/advisories/CVE-2026-45159/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:39:38 GMTCVECVE-2026-45157: Nextcloud: Valid share tokens allow to access tempory upload files of share ownerhttps://agentprime.io/advisories/CVE-2026-45157/https://agentprime.io/advisories/CVE-2026-45157/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:39:12 GMTCVECVE-2026-45156: Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDChttps://agentprime.io/advisories/CVE-2026-45156/https://agentprime.io/advisories/CVE-2026-45156/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:38:46 GMTCVECVE-2026-45155: Nextcloud: Private circle can be added to another circle via APIhttps://agentprime.io/advisories/CVE-2026-45155/https://agentprime.io/advisories/CVE-2026-45155/CVSS 2.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:38:33 GMTCVECVE-2026-45154: Nextcloud: Improper Access Control in Collectiveshttps://agentprime.io/advisories/CVE-2026-45154/https://agentprime.io/advisories/CVE-2026-45154/CVSS 2.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:37:41 GMTCVECVE-2026-45153: Nextcloud: PIN bypass in PassCodeActivity via back buttonhttps://agentprime.io/advisories/CVE-2026-45153/https://agentprime.io/advisories/CVE-2026-45153/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:37:12 GMTCVECVE-2026-45264: Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renameshttps://agentprime.io/advisories/CVE-2026-45264/https://agentprime.io/advisories/CVE-2026-45264/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 16:36:57 GMTCVECVE-2025-66558: Nextcloud Twofactor WebAuthn app was updated based on public keyhttps://agentprime.io/advisories/CVE-2025-66558/https://agentprime.io/advisories/CVE-2025-66558/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 18:00:49 GMTCVECVE-2025-66556: Nextcloud talk allows participants to blindly delete poll drafts of other users by IDhttps://agentprime.io/advisories/CVE-2025-66556/https://agentprime.io/advisories/CVE-2025-66556/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:56:44 GMTCVECVE-2025-66554: Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title fieldhttps://agentprime.io/advisories/CVE-2025-66554/https://agentprime.io/advisories/CVE-2025-66554/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:50:59 GMTCVECVE-2025-66549: Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directoryhttps://agentprime.io/advisories/CVE-2025-66549/https://agentprime.io/advisories/CVE-2025-66549/CVSS 2.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:47:00 GMTCVECVE-2025-66545: Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash binhttps://agentprime.io/advisories/CVE-2025-66545/https://agentprime.io/advisories/CVE-2025-66545/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:44:13 GMTCVECVE-2025-66515: Nextcloud Approval app allows users to request approval for other users filehttps://agentprime.io/advisories/CVE-2025-66515/https://agentprime.io/advisories/CVE-2025-66515/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:37:06 GMTCVECVE-2025-66514: Nextcloud Mail stored HTML injection in subject texthttps://agentprime.io/advisories/CVE-2025-66514/https://agentprime.io/advisories/CVE-2025-66514/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:32:25 GMTCVECVE-2025-66557: Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-ownershttps://agentprime.io/advisories/CVE-2025-66557/https://agentprime.io/advisories/CVE-2025-66557/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:28:48 GMTCVECVE-2025-66548: Nextcloud Deck app allows to spoof file extensions by using RTLO charactershttps://agentprime.io/advisories/CVE-2025-66548/https://agentprime.io/advisories/CVE-2025-66548/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:26:11 GMTCVECVE-2025-66553: Nextcloud Tables app allowed users to view columns metadata information of any tablehttps://agentprime.io/advisories/CVE-2025-66553/https://agentprime.io/advisories/CVE-2025-66553/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:18:09 GMTCVECVE-2025-66551: Nextcloud Tables is missing an ownership check which allows moving columns into tables of other usershttps://agentprime.io/advisories/CVE-2025-66551/https://agentprime.io/advisories/CVE-2025-66551/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:15:16 GMTCVECVE-2025-66513: Nextcloud Tables app share information not limited to relevant usershttps://agentprime.io/advisories/CVE-2025-66513/https://agentprime.io/advisories/CVE-2025-66513/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 17:11:19 GMTCVECVE-2025-66550: Nextcloud Calendar attachments of local files are offered to downloadedhttps://agentprime.io/advisories/CVE-2025-66550/https://agentprime.io/advisories/CVE-2025-66550/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 16:56:44 GMTCVECVE-2025-66546: Nextcloud Calendar app allowed booking appointments without the generated tokenhttps://agentprime.io/advisories/CVE-2025-66546/https://agentprime.io/advisories/CVE-2025-66546/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 16:49:46 GMTCVECVE-2025-66511: Nextcloud Calendar app used predictable proposal participant tokenshttps://agentprime.io/advisories/CVE-2025-66511/https://agentprime.io/advisories/CVE-2025-66511/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 16:42:30 GMTCVECVE-2025-66552: Nextcloud Server admin_audit does not log all actions on files in groupfoldershttps://agentprime.io/advisories/CVE-2025-66552/https://agentprime.io/advisories/CVE-2025-66552/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 16:36:39 GMTCVECVE-2025-66547: Nextcloud Server users can modify tags on files that do not belong to themhttps://agentprime.io/advisories/CVE-2025-66547/https://agentprime.io/advisories/CVE-2025-66547/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 16:32:17 GMTCVECVE-2025-66512: Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloudhttps://agentprime.io/advisories/CVE-2025-66512/https://agentprime.io/advisories/CVE-2025-66512/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 16:22:50 GMTCVECVE-2025-66510: Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact listhttps://agentprime.io/advisories/CVE-2025-66510/https://agentprime.io/advisories/CVE-2025-66510/CVSS 4.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Dec 2025 16:18:53 GMTCVECVE-2025-58051: Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a tablehttps://agentprime.io/advisories/CVE-2025-58051/https://agentprime.io/advisories/CVE-2025-58051/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Oct 2025 16:48:19 GMTCVECVE-2025-47794: Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permissionhttps://agentprime.io/advisories/CVE-2025-47794/https://agentprime.io/advisories/CVE-2025-47794/CVSS 2.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 May 2025 14:35:25 GMTCVECVE-2025-47793: Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text filehttps://agentprime.io/advisories/CVE-2025-47793/https://agentprime.io/advisories/CVE-2025-47793/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 May 2025 14:31:50 GMTCVECVE-2025-47792: Nextcloud Desktop 3rdparty applications can create share links via socket APIhttps://agentprime.io/advisories/CVE-2025-47792/https://agentprime.io/advisories/CVE-2025-47792/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 May 2025 14:13:53 GMTCVECVE-2025-47791: Nextcloud Server's test remote endpoint is not rate limitedhttps://agentprime.io/advisories/CVE-2025-47791/https://agentprime.io/advisories/CVE-2025-47791/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 May 2025 14:09:27 GMTCVE