Nextcloud · weakness class
Denial of Service
20 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.
- A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.
- Malicious user could break user administration page
- High memory usage in Nextcloud server
- A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later inter…
- Improper input-size validation on the user new session name in Nextcloud Server
- nextcloud vulnerable to Uncontrolled Resource Consumption
- Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trigger an endless recur…
- Database resource exhaustion for logged-in users via sharee recommendations with circles
- Missing length validation of user displayname in nextcloud server
- Nextcloud Server's calendar name length not validated before writing to database
- Nextcloud Server has no password length limit when creating a user as an administrator
- Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended
- Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file
- Missing brute force protection on cloud federation sharing in Nextcloud Server
- Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users.
- Nextcloud Deck vulnerable to uncontrolled resource consumption
- Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server
- Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive
- A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.
- Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic clean…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.