Server

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.CVE-2026-77165Nextcloud · CVSS 6.5 · 0.4% likely

   CWE-2841 bounty report

2. The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album own…CVE-2026-82985Nextcloud · CVSS 6.5 · 0.4% likely

   CWE-2841 bounty report

3. Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic clean…CVE-2026-77167Nextcloud · CVSS 7.5 · 0.4% likely

   CWE-4001 bounty report

4. App passwords were allowed to bypass password confirmation on sensitive endpoints.CVE-2026-77172Nextcloud · CVSS 5.3 · 0.3% likely

   CWE-2691 bounty report

5. When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint…CVE-2026-82984Nextcloud · CVSS 4.3 · 0.3% likely

   CWE-2841 bounty report

6. After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.CVE-2026-68493Nextcloud · CVSS 3.1 · 0.2% likely

   CWE-6391 bounty report

7. Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private add…CVE-2026-77164Nextcloud · CVSS 6.2 · 0.2% likely

   CWE-9181 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.