Product by Nextcloud
Nextcloud Deck
18 known vulnerabilities in Nextcloud Deck (Nextcloud), 0 of them actively exploited (CISA KEV).
Key figures
18
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2021-39225 | Missing permission check on Deck API | 8.1 | |
| Medium | CVE-2021-22913 | Nextcloud Deck: Exposure of Sensitive Information to an Unauthorized Actor | 6.5 | |
| High | CVE-2020-8182 | Nextcloud Deck: Improper Access Control | 8.0 | |
| Medium | CVE-2021-37631 | Circle can be accessed by non-Circle members in Nextcloud Deck | 6.5 | |
| Medium | CVE-2020-8297 | Nextcloud Deck: Authorization Bypass Through User-Controlled Key | 4.3 | |
| Medium | CVE-2022-29159 | Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck | 5.0 | |
| Medium | CVE-2023-22469 | Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache | 5.8 | |
| Medium | CVE-2022-24906 | Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck | 3.5 | |
| Medium | CVE-2026-77170 | Nextcloud Deck: Improper Access Control | 4.3 | |
| Medium | CVE-2019-15619 | Nextcloud Server: Cross-site Scripting | 4.8 | |
| Medium | CVE-2020-8235 | Nextcloud Deck app: Authorization Bypass Through User-Controlled Key | 4.3 | |
| Medium | CVE-2025-66557 | Nextcloud Security-advisories: Improper Access Control | 5.4 | |
| Medium | CVE-2023-22470 | Nextcloud Deck vulnerable to uncontrolled resource consumption | 3.5 | |
| Medium | CVE-2020-8179 | Nextcloud Deck: Improper Access Control | 4.1 | |
| Medium | CVE-2023-22471 | Nextcloud Deck vulnerable to authorization bypass | 3.5 | |
| Medium | CVE-2024-37883 | Nextcloud Deck can access comments and attachments of deleted cards | 4.3 | |
| Medium | CVE-2025-66548 | Nextcloud Deck app allows to spoof file extensions by using RTLO characters | 3.3 | |
| Medium | CVE-2024-22213 | Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app | — |