Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

security-advisories — Vulnerabilities & Security Advisories 276

All 276 CVE vulnerabilities found in security-advisories, with AI-generated Chinese analysis, references, and POCs.

This page serves as a comprehensive aggregation hub for the security-advisories product, focusing on widely recognized common weakness types and specific security tags. It collects detailed reports on software vulnerabilities, configuration errors, and design flaws across various operating systems and applications. The database covers security advisories issued from 2010 to the present, ensuring a broad historical perspective on emerging threats and patch management practices. Users can utilize this resource to track a vendor's advisory history, gaining insight into their response times and frequency of disclosures. It allows security professionals to understand the characteristics and impact of specific weakness classes by correlating multiple reports that reference the same Common Weakness Enumeration identifiers. Additionally, individuals can look up a product's vulnerability history to assess its security posture over time, identifying recurring issues or persistent flaws in specific software versions. This structured approach facilitates efficient risk assessment and informs decisions regarding software selection and mitigation strategies. By centralizing disparate sources of security information, the platform reduces the effort required to manually search for relevant bulletins. The data is organized to highlight trends in vulnerability discovery and resolution, supporting proactive security management. Whether for researchers analyzing attack surfaces or administrators verifying patch levels, this collection provides a reliable foundation for understanding the landscape of disclosed security issues.

Vendor: nextcloud

CVE ID Title CVSS Severity Published
CVE-2026-81515 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CWE-755 7.5 High 2026-09-17
CVE-2026-81516 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CWE-755 7.5 High 2026-09-17
CVE-2026-81868 Steeltoe: Header-forwarded client cert lacks proof of private-key possession CWE-288 6.5 Medium 2026-09-17
CVE-2026-75523 Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets CWE-200 5.9 Medium 2026-09-17
CVE-2026-24754 Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting CWE-79 5.4 Medium 2026-06-01
CVE-2026-45810 Nextcloud: Propfind requests for file comments allowed to load comments for other files CWE-639 6.8 Medium 2026-06-01
CVE-2026-45722 Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views CWE-89 7.1 High 2026-06-01
CVE-2026-45691 Nextcloud: Bypass of second factor authentication on DAV endpoints CWE-287 5.9 Medium 2026-06-01
CVE-2026-45690 Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay CWE-287 5.9 Medium 2026-06-01
CVE-2026-45545 Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution CWE-89 8.2 High 2026-06-01
CVE-2026-45544 Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService CWE-1230 4.3 Medium 2026-06-01
CVE-2026-45543 Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share CWE-552 5.3 Medium 2026-06-01
CVE-2026-45286 Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint CWE-200 4.3 Medium 2026-06-01
CVE-2026-45284 Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate CWE-284 4.6 Medium 2026-06-01
CVE-2026-45285 Nextcloud: Hidden Public Link creation when sharing to a Team External Member CWE-862 6.4 Medium 2026-06-01
CVE-2026-45283 Nextcloud: Files Lock app allows users to lock and unlock files of other users CWE-287 6.3 Medium 2026-06-01
CVE-2026-45282 Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access CWE-284 6.5 Medium 2026-06-01
CVE-2026-45281 Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update CWE-639 8.1 High 2026-06-01
CVE-2026-45279 Nextcloud: Limited path traversal via template API if using `{lang}` in config CWE-22 4.4 Medium 2026-06-01
CVE-2026-45278 Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass CWE-601 3.3 Low 2026-06-01
CVE-2026-45277 Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations CWE-200 3.3 Low 2026-06-01
CVE-2026-45275 Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers CWE-285 6.5 Medium 2026-06-01
CVE-2026-45267 Nextcloud: Missing permission check for from submissions CWE-200 6.5 Medium 2026-06-01
CVE-2026-45266 Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling CWE-284 3.5 Low 2026-06-01
CVE-2026-45159 Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner CWE-639 3.5 Low 2026-06-01
CVE-2026-45157 Nextcloud: Valid share tokens allow to access tempory upload files of share owner CWE-284 6.3 Medium 2026-06-01
CVE-2026-45156 Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC CWE-287 8.1 High 2026-06-01
CVE-2026-45155 Nextcloud: Private circle can be added to another circle via API CWE-639 2.6 Low 2026-06-01
CVE-2026-45154 Nextcloud: Improper Access Control in Collectives CWE-284 2.6 Low 2026-06-01
CVE-2026-45153 Nextcloud: PIN bypass in PassCodeActivity via back button CWE-287 4.6 Medium 2026-06-01

All 276 known CVE vulnerabilities affecting security-advisories with full Chinese analysis, references, and POCs where available.