Nextcloud · disclosed reports
Cryptography
28 disclosed reports · $2,250 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 28
- paid a bounty
- 5
Every one of the 28 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Clear text storage of proxy parameters and passwords
- SSL certificate not validated when registering with a provider
- Invisible Salamanders Attack against end_to_end_encryption in Nextcloud
- Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com
- OAuth2 client_secret stored in plain text in the database
- Passwords being stored as plain text in logging
- ID4ME does not validate signature or expiration
- user_ldap app logs user passwords in the log file on level debug
- X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted files
- Predictable proposal participant tokens enable unauthorized access and vote submission
- [user_oidc] Unencrypted Communications
- OAuth2 Access Token and App Password Security Vulnerability
- Password disclosure in initial setup of Mail App
- Desktop client does not verify received singed certificate in end to end encryption
- Predictable Random Number Generator
- nextcloudcmd incorrectly trusts bad TLS certificates
- Vulnerable moment-timezone version shipped
- Reduced purmations on encryption
- Mail does not verify IMAP/SMTP host connected via TLS
- Update php-saml library to 2.10.5
- Insecure randomness for default password in file sharing when password policy app is disabled
- Downgrade encryption scheme and break integrity through known-plaintext attack
- Missing DNSSEC
- Exception logging in Sharepoint app reveals clear-text connection details
- Social App does not validate server certificates for outgoing connections
- Accessing to download.nextcloud.com from original ip adreess | insecure Download
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.