# Nextcloud Server. Every CVE that names Nextcloud Server among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2026-82984.md) `CVE-2026-82984` · CVE record: Nextcloud Server · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control - [Uncontrolled resource consumption in Nextcloud server](https://agentprime.io/advisories/CVE-2026-77167.md) `CVE-2026-77167` · CVE record: Nextcloud server · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service - [Improper privilege management in Nextcloud Server](https://agentprime.io/advisories/CVE-2026-77172.md) `CVE-2026-77172` · CVE record: Nextcloud Server · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation - [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2026-77165.md) `CVE-2026-77165` · CVE record: Nextcloud Server · CVSS 6.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Insecure direct object reference in Nextcloud Server](https://agentprime.io/advisories/CVE-2026-68493.md) `CVE-2026-68493` · CVE record: Nextcloud Server · CVSS 3.1 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control - [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2026-82985.md) `CVE-2026-82985` · CVE record: Nextcloud Server · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control - [Server-side request forgery in Nextcloud Server](https://agentprime.io/advisories/CVE-2026-77164.md) `CVE-2026-77164` · CVE record: Nextcloud Server · CVSS 6.2 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Unlimited authentication attempts in Nextcloud Server](https://agentprime.io/advisories/CVE-2021-22915.md) `CVE-2021-22915` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 11 Jun 2021 · Tags: Authentication bypass - [Nextcloud Server: Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when…](https://agentprime.io/advisories/CVE-2020-8296.md) `CVE-2020-8296` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 3 Mar 2021 · Tags: CWE-257 - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2021-22878.md) `CVE-2021-22878` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 3 Mar 2021 · Tags: Cross-site scripting (XSS) - [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2021-22877.md) `CVE-2021-22877` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 3 Mar 2021 · Tags: Broken access control - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8294.md) `CVE-2020-8294` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 3 Feb 2021 · Tags: Cross-site scripting (XSS) - [Uncontrolled resource consumption in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8295.md) `CVE-2020-8295` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 26 Jan 2021 · Tags: Denial of service - [Uncontrolled resource consumption in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8293.md) `CVE-2020-8293` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 26 Jan 2021 · Tags: Denial of service - [Insufficiently protected credentials in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8259.md) `CVE-2020-8259` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 16 Nov 2020 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8152.md) `CVE-2020-8152` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 16 Nov 2020 · Tags: Hard-coded credentials - [Nextcloud Server: A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1…](https://agentprime.io/advisories/CVE-2020-8133.md) `CVE-2020-8133` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 9 Nov 2020 · Tags: CWE-657 - [Nextcloud Server: A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the…](https://agentprime.io/advisories/CVE-2020-8150.md) `CVE-2020-8150` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 9 Nov 2020 · Tags: CWE-310 - [Plaintext password storage in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8183.md) `CVE-2020-8183` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Oct 2020 · Tags: CWE-256 - [Nextcloud Server: A too small set of random characters being used for encryption in Nextcloud Server 18.0.4…](https://agentprime.io/advisories/CVE-2020-8173.md) `CVE-2020-8173` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Oct 2020 · Tags: CWE-310 - [Improper authentication in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8236.md) `CVE-2020-8236` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Oct 2020 · Tags: Authentication bypass - [Improper privilege management in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8223.md) `CVE-2020-8223` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Oct 2020 · Tags: Privilege escalation - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8155.md) `CVE-2020-8155` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 12 May 2020 · Tags: Cross-site scripting (XSS) - [Insecure direct object reference in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8154.md) `CVE-2020-8154` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 12 May 2020 · Tags: Broken access control - [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8139.md) `CVE-2020-8139` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 20 Mar 2020 · Tags: Broken access control - [Server-side request forgery in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8138.md) `CVE-2020-8138` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 20 Mar 2020 · Tags: Server-side request forgery (SSRF) - [Improper access control in Nextcloud server](https://agentprime.io/advisories/CVE-2020-8122.md) `CVE-2020-8122` · CVE record: Nextcloud server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Broken access control - [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8121.md) `CVE-2020-8121` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Broken access control - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8120.md) `CVE-2020-8120` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Cross-site scripting (XSS) - [Improper authorization in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8119.md) `CVE-2020-8119` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Broken access control - [Server-side request forgery in Nextcloud Server](https://agentprime.io/advisories/CVE-2020-8118.md) `CVE-2020-8118` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Server-side request forgery (SSRF) - [Nextcloud Server: Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details…](https://agentprime.io/advisories/CVE-2020-8117.md) `CVE-2020-8117` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: CWE-280 - [Nextcloud Server: Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users…](https://agentprime.io/advisories/CVE-2019-15624.md) `CVE-2019-15624` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 - [Exposure of personal information in Nextcloud Server](https://agentprime.io/advisories/CVE-2019-15623.md) `CVE-2019-15623` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Information disclosure - [Nextcloud Server: Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to…](https://agentprime.io/advisories/CVE-2019-15621.md) `CVE-2019-15621` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2019-15619.md) `CVE-2019-15619` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2019-15618.md) `CVE-2019-15618` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Cross-site scripting (XSS) - [Improper authentication in Nextcloud Server](https://agentprime.io/advisories/CVE-2019-15617.md) `CVE-2019-15617` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Authentication bypass - [CRLF injection in Nextcloud Server](https://agentprime.io/advisories/CVE-2019-15616.md) `CVE-2019-15616` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Other injection - [Improper input validation in Nextcloud Server](https://agentprime.io/advisories/CVE-2019-15613.md) `CVE-2019-15613` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: CWE-20 - [Session fixation in Nextcloud Server](https://agentprime.io/advisories/CVE-2019-15612.md) `CVE-2019-15612` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 4 Feb 2020 · Tags: Authentication bypass - [Improper authentication in Nextcloud Server](https://agentprime.io/advisories/CVE-2019-5449.md) `CVE-2019-5449` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Jul 2019 · Tags: Authentication bypass - [Information disclosure in Nextcloud Server](https://agentprime.io/advisories/CVE-2018-16467.md) `CVE-2018-16467` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Oct 2018 · Tags: Information disclosure - [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2018-16466.md) `CVE-2018-16466` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Oct 2018 · Tags: Broken access control - [Improper authentication in Nextcloud Server](https://agentprime.io/advisories/CVE-2018-16465.md) `CVE-2018-16465` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Oct 2018 · Tags: Authentication bypass - [Improper authentication in Nextcloud Server](https://agentprime.io/advisories/CVE-2018-16464.md) `CVE-2018-16464` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Oct 2018 · Tags: Authentication bypass - [Session fixation in Nextcloud Server](https://agentprime.io/advisories/CVE-2018-16463.md) `CVE-2018-16463` · CVE record: Nextcloud Server · No CVSS score · Not analysed yet · Published 30 Oct 2018 · Tags: Authentication bypass - [Cross-site scripting in nextcloud/server](https://agentprime.io/advisories/CVE-2018-3780.md) `CVE-2018-3780` · CVE record: NextCloud nextcloud/server · No CVSS score · Not analysed yet · Published 13 Aug 2018 · Tags: Cross-site scripting (XSS) - [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2018-3762.md) `CVE-2018-3762` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Jul 2018 · Tags: Broken access control - [Improper authentication in Nextcloud Server](https://agentprime.io/advisories/CVE-2018-3761.md) `CVE-2018-3761` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Jul 2018 · Tags: Authentication bypass - [Insecure direct object reference in Nextcloud Server](https://agentprime.io/advisories/CVE-2017-0936.md) `CVE-2017-0936` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 28 Mar 2018 · Tags: Broken access control - [Improper authorization in Nextcloud Server](https://agentprime.io/advisories/CVE-2017-0895.md) `CVE-2017-0895` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 8 May 2017 · Tags: Broken access control - [Improper authorization in Nextcloud Server](https://agentprime.io/advisories/CVE-2017-0894.md) `CVE-2017-0894` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 8 May 2017 · Tags: Broken access control - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2017-0893.md) `CVE-2017-0893` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 8 May 2017 · Tags: Cross-site scripting (XSS) - [Improper authorization in Nextcloud Server](https://agentprime.io/advisories/CVE-2017-0892.md) `CVE-2017-0892` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 8 May 2017 · Tags: Broken access control - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2017-0891.md) `CVE-2017-0891` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 8 May 2017 · Tags: Cross-site scripting (XSS) - [Cross-site scripting in Nextcloud Server](https://agentprime.io/advisories/CVE-2017-0890.md) `CVE-2017-0890` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 8 May 2017 · Tags: Cross-site scripting (XSS) - [Nextcloud Server: Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability…](https://agentprime.io/advisories/CVE-2017-0888.md) `CVE-2017-0888` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Apr 2017 · Tags: CWE-451 - [Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation.](https://agentprime.io/advisories/CVE-2017-0887.md) `CVE-2017-0887` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Apr 2017 · Tags: CWE-807 - [Uncontrolled recursion in Nextcloud Server](https://agentprime.io/advisories/CVE-2017-0886.md) `CVE-2017-0886` · CVE record: Nextcloud Nextcloud Server · No CVSS score · Not analysed yet · Published 5 Apr 2017 · Tags: Denial of service Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .