~/security / nextcloud
Nextcloud: latest vulnerabilities
The newest CVEs for Nextcloud, daily from the NVD. Descriptions come from the database.
| CVE | Published | Severity | Description |
|---|---|---|---|
| CVE-2026-107059 | 29 October 2026 | high 7.5 | An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication. |
| CVE-2026-104189 | 27 October 2026 | high 7.5 | The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token co… |
| CVE-2026-110447 | 14 October 2026 | critical 9.2 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in … |
| CVE-2026-77164 | 18 September 2026 | medium 6.2 | Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public,… |
| CVE-2026-55640 | 25 August 2026 | critical 9.1 | Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHO… |
Shows the current state live and links to this page (refreshed every 6 hours). Free, no signup.
[](https://daniele-michelin.com/en/vulnerabilities/nextcloud/)
<a href="https://daniele-michelin.com/en/vulnerabilities/nextcloud/"><img src="https://daniele-michelin.com/tools/api/vbadge.php?t=cve&p=nextcloud" alt="Nextcloud CVEs" height="20"></a>New articles by e-mail
One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).