Server-Side Request Forgery

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

1. A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a…CVE-2020-8138Nextcloud · 1.4% likely

   CWE-9181 bounty report

2. An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.CVE-2020-8118Nextcloud · 1.3% likely

   CWE-9181 bounty report

3. Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud ServerCVE-2022-39211nextcloud · CVSS 3 · 1.0% likely

   CWE-9181 bounty report

4. Blind SSRF via server URL input in the Nextcloud Mail appCVE-2023-23943nextcloud · CVSS 5 · 0.9% likely

   CWE-9183 bounty reports

5. Nextcloud Mail app vulnerable to Server-Side Request ForgeryCVE-2023-48307nextcloud · CVSS 3.5 · 0.9% likely

   CWE-9181 bounty report

6. Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPsCVE-2023-25162nextcloud · CVSS 5.3 · 0.8% likely

   CWE-918

7. Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRFCVE-2023-48306nextcloud · CVSS 5 · 0.8% likely

   CWE-9181 bounty report

8. Require strict cookies for image proxy requests in Nextcloud MailCVE-2023-45660nextcloud · CVSS 4.3 · 0.8% likely

   CWE-9181 bounty report

9. Unauthenticated SSRF in 3rd party module "cerdic/csstidy"CVE-2022-31132nextcloud · CVSS 8.3 · 0.7% likely

   CWE-9181 bounty report

10. Blind SSRF in the Nextcloud Mail app on avatar endpointCVE-2023-33184nextcloud · CVSS 3.5 · 0.5% likely

    CWE-9181 bounty report

11. Nextcloud Server's test remote endpoint is not rate limitedCVE-2025-47791nextcloud · CVSS 4.3 · 0.4% likely

    CWE-918

12. A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker cou…CVE-2026-87897Nextcloud · CVSS 4.6 · 0.2% likely

    CWE-9181 bounty report

13. Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private add…CVE-2026-77164Nextcloud · CVSS 6.2 · 0.2% likely

    CWE-9181 bounty report

14. Nextcloud News: Authenticated blind SSRF via feed URLCVE-2026-44515nextcloud · CVSS 2.3 · 0.2% likely

    CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.