Recent Advisories

Severity ID Title Vendor Product Date Type
LOW 3.3 CVE-2025-66331

CVE-2025-66331_CVE-2025-66331

Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.

Huawei HarmonyOS 5.1.0 CVE
LOW 3.3 CVE-2025-66334

CVE-2025-66334_CVE-2025-66334

Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.

Huawei HarmonyOS 5.1.0 CVE
LOW 3.3 CVE-2025-66546

Nextcloud Calendar app allowed booking appointments without the generated token_CVE-2025-66546

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a...

nextcloud security-advisories >= 6.0.0-rc.1, < 6.0.1 CVE
LOW 3.3 CVE-2025-66548

Nextcloud Deck app allows to spoof file extensions by using RTLO characters_CVE-2025-66548

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior t...

nextcloud security-advisories >= 1.15.0-beta.1, < 1.15.1 CVE
LOW 3.5 CVE-2025-66514

Nextcloud Mail stored HTML injection in subject text_CVE-2025-66514

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's messag...

nextcloud security-advisories >= 5.2.0-beta.1, < 5.5.3 CVE
LOW 2.7 CVE-2025-66515

Nextcloud Approval app allows users to request approval for other users file_CVE-2025-66515

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requ...

nextcloud security-advisories >= 2.0.0, < 2.5.0 CVE
LOW 2.4 CVE-2025-66549

Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory_CVE-2025-66549

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted dir...

nextcloud security-advisories < 3.16.5 CVE
LOW 3.5 CVE-2025-66545

Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin_CVE-2025-66545

Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8...

nextcloud security-advisories < 14.0.11 CVE
LOW 3.5 CVE-2025-66554

Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field_CVE-2025-66554

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a m...

nextcloud security-advisories >= 7.0.0-alpha.1, < 7.2.5 CVE
LOW 3.5 CVE-2025-66556

Nextcloud talk allows participants to blindly delete poll drafts of other users by ID_CVE-2025-66556

Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delet...

nextcloud security-advisories < 20.1.8 CVE