Nextcloud

The 3D Viewer for Nextcloud application contains an authentication bypass vulnerability that allows unauthenticated users to access password-protected 3D model files via a valid share token.

Nextcloud disclosed multiple vulnerabilities across its server platform and various applications, including Tables, Whiteboard, Files Confidential, Collectives, and Richdocuments, which could allow attackers to bypass security controls, manipulate data, or cause Denial-of-Service.

A critical vulnerability in Nextcloud Hub, tracked as CVE-2024-28112, allows remote attackers to execute arbitrary code on the underlying application server.

An unauthenticated remote attacker can delete or corrupt semantic search vector embeddings in Qdrant by sending a crafted POST request to the /webhooks/nextcloud endpoint due to missing default authentication.

Multiple vulnerabilities, including CVE-2026-61527 and CVE-2026-61545, affect Nextcloud Server and Mail components, posing risks to data confidentiality and security policy enforcement.

Multiple vulnerabilities exist in Nextcloud, allowing an attacker to bypass security measures, disclose information, and conduct SQL injection attacks.

Multiple vulnerabilities in Nextcloud products can lead to data confidentiality breaches, data integrity compromise, and security policy bypass.