Product by Nextcloud
Nextcloud Calendar application
10 known vulnerabilities in Nextcloud Calendar application (Nextcloud), 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-24838 | Command Injection in Appointment Emails for Nextcloud Calendar | 5.3 | |
| Medium | CVE-2025-66550 | Nextcloud Calendar attachments of local files are offered to downloaded | 5.7 | |
| Medium | CVE-2018-3763 | Nextcloud Calendar application: Cross-site Scripting | 4.8 | |
| Medium | CVE-2026-45286 | Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint | 4.3 | |
| Medium | CVE-2025-66511 | Nextcloud Calendar app used predictable proposal participant tokens | 4.8 | |
| Medium | CVE-2023-45150 | Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive | 4.3 | |
| Medium | CVE-2023-48308 | Calendar app returns full stacktrace when an error happens while editing appointment | 3.5 | |
| Medium | CVE-2024-37316 | Nextcloud Calendar's event create can create attachments that link to other websites | 4.6 | |
| Low | CVE-2025-66546 | Nextcloud Calendar app allowed booking appointments without the generated token | 3.3 | |
| Medium | CVE-2023-33183 | Error in calendar when booking an appointment reveals the full path of the website | 2.6 |