No rate limiting for confirmation email lead to huge Mass mailings Analysed #997070 Valid Input Validation and Logic Medium 2020-11-04 – 82 Directory Listing of publicly available assets Analysed #2311179 Valid Information Disclosure Medium 2025-09-29 – 70 File-drop content is visible through the gallery app Analysed #719426 Valid No weakness recorded Medium 2020-01-31 – 68 ID4me feature of OpenID connect app available even when disabled Analysed #2376929 Valid Access Control Medium 2024-05-30 – 66 SVG filter primitives bypass remote image blocking, enabling email tracking without consent. Analysed #3486747 Valid Information Disclosure Medium 2026-04-20 – 53 Exposing debug.log file leads to server full path disclosure Analysed #2778441 Valid Input Validation and Logic Medium 2025-09-29 – 47 Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes Analysed #3443563 Valid Information Disclosure Medium 2026-01-14 – 46 Unauthenticated testing endpoint of notify_push expose internal IP Analysed #3513471 Valid Information Disclosure Medium 2026-09-05 $150 38 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com Analysed #2446531 Valid Cryptography Medium 2024-05-22 – 37 Unquoted body background attribute enables CSS injection that bypasses remote image blocking Analysed #3590583 Valid Injection and Smuggling Medium 2026-04-20 – 35 Cross site scripting - XSRF Token Analysed #858255 Valid Cross-site Scripting Medium 2020-06-14 – 32 Bruteforce protection in password verification can be bypassed Analysed #2230915 Valid Authentication Medium 2024-01-17 – 31 IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email Analysed #230328 Valid Insecure Direct Object Reference Medium 2017-09-16 – 29 Password of talk conversations can be bruteforced Analysed #2094473 Valid Authentication Medium 2023-11-12 – 27 SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent Analysed #3590576 Valid File and Path Handling Medium 2026-04-20 – 26 Bypass of privacy filter / tracking pixel blocker Analysed #1215251 Valid Information Disclosure Medium 2021-08-11 $100 24 Improper restriction of excessive authentication attempts on WebDAV endpoint Analysed #1924212 Valid Authentication Medium 2023-08-10 – 23 Possible denial of service when entering a loooong password Analysed #840598 Valid Authentication Medium 2020-07-29 $100 23