Product by Nextcloud
Nextcloud Forms
20 known vulnerabilities in Nextcloud Forms (Nextcloud), 0 of them actively exploited (CISA KEV).
Key figures
20
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-45156 | Nextcloud Security-advisories: Improper Authentication | 8.1 | |
| High | CVE-2026-45281 | Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update | 8.1 | |
| Medium | CVE-2026-45275 | Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers | 6.5 | |
| Medium | CVE-2026-45282 | Nextcloud Security-advisories: Improper Access Control | 6.5 | |
| Medium | CVE-2026-45267 | Nextcloud: Missing permission check for from submissions | 6.5 | |
| Medium | CVE-2026-45285 | Nextcloud: Hidden Public Link creation when sharing to a Team External Member | 6.4 | |
| Medium | CVE-2026-45157 | Nextcloud: Valid share tokens allow to access tempory upload files of share owner | 6.3 | |
| Medium | CVE-2026-45283 | Nextcloud: Files Lock app allows users to lock and unlock files of other users | 6.3 | |
| Medium | CVE-2026-45279 | Nextcloud: Limited path traversal via template API if using `{lang}` in config | 4.4 | |
| Medium | CVE-2026-45543 | Nextcloud Security-advisories: Files or Directories Accessible to External Parties | 5.3 | |
| Medium | CVE-2026-45286 | Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint | 4.3 | |
| High | CVE-2026-45284 | Nextcloud Security-advisories: Improper Access Control | 4.6 | |
| Medium | CVE-2026-45153 | Nextcloud: PIN bypass in PassCodeActivity via back button | 4.6 | |
| Medium | CVE-2026-45264 | Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames | 4.3 | |
| Low | CVE-2026-45266 | Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling | 3.5 | |
| Low | CVE-2026-45159 | Nextcloud Security-advisories: Authorization Bypass Through User-Controlled Key | 3.5 | |
| Medium | CVE-2026-45278 | Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass | 3.3 | |
| Low | CVE-2026-45277 | Nextcloud Security-advisories: Exposure of Sensitive Information to an Unauthorized Actor | 3.3 | |
| Low | CVE-2026-45155 | Nextcloud: Private circle can be added to another circle via API | 2.6 | |
| Low | CVE-2026-45154 | Nextcloud: Improper Access Control in Collectives | 2.6 |