nextcloud desktop

Name: nextcloud desktop
Brand: nextcloud

productUS

cpe:2.3:a:nextcloud:desktop:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

1critical8high17medium1low

updated 2026-10-28

vulnerabilities (27)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-52510US	high7.5	0.78% (56th)	Exploit	3.14.2	2024-11-15	3.0.0 → 3.14.2
CVE-2020-8227US	medium6.8	25.8% (98th)	—	2.6.5	2020-08-21	< 2.6.5
CVE-2021-22879US	high8.8	5.04% (92nd)	—	3.1.3	2021-04-14	< 3.1.3
CVE-2020-8189US	medium5.4	1.40% (72nd)	—	2.6.5	2020-08-21	< 2.6.5
CVE-2023-28997US	medium6.5	1.07% (65th)	—	3.6.5	2023-04-04	3.0.0 → 3.6.5
CVE-2021-22895US	medium5.9	1.04% (64th)	—	3.1.3	2021-06-11	< 3.1.3
CVE-2022-39332US	medium5.4	0.94% (61st)	—	3.6.1	2022-11-25	< 3.6.1
CVE-2022-39333US	medium6.1	0.94% (61st)	—	3.6.1	2022-11-25	< 3.6.1
CVE-2022-39331US	medium5.4	0.92% (60th)	—	3.6.1	2022-11-25	< 3.6.1
CVE-2020-8225US	high7.5OT elevated	0.91% (60th)	—	2.6.5	2020-09-18	< 2.6.5
CVE-2021-32728US	medium6.5	0.85% (58th)	—	3.3.0	2021-08-18	< 3.3.0
CVE-2020-8140US	medium6.7	0.69% (53rd)	—	2.6.3	2020-03-20	< 2.6.3
CVE-2023-23942US	medium6.1	0.68% (52nd)	—	3.6.3	2023-02-06	< 3.6.3
CVE-2023-28998US	medium6.1	0.68% (52nd)	—	3.6.5	2023-04-04	3.0.0 → 3.6.5
CVE-2023-28999US	medium6.4OT elevated	0.68% (52nd)	—	3.8.0	2023-04-04	3.0.0 → 3.8.0
CVE-2020-8224US	high7.8	0.66% (52nd)	—	2.6.5	2020-08-10	< 2.6.5
CVE-2024-46958US	critical9.1OT elevated	0.56% (46th)	—	3.13.4	2024-09-16	3.13.1 → 3.13.4
CVE-2022-41882US	high7.8	0.49% (42nd)	—	no fix	2022-11-11	= 3.6.0
CVE-2020-8229US	medium5.5	0.47% (40th)	—	2.6.5	2020-08-10	< 2.6.5
CVE-2021-37617US	high7.3	0.46% (39th)	—	3.3.0	2021-08-18	3.0.3 → 3.3.0
CVE-2023-29000US	medium6.5	0.39% (33rd)	—	3.7.0	2023-04-04	3.0.0 → 3.7.0
CVE-2020-8230US	medium5.5	0.35% (29th)	—	2.6.5	2020-08-17	< 2.6.5
CVE-2024-37885US	high7.8	0.32% (25th)	—	3.12.0	2024-06-14	< 3.12.0
CVE-2025-66549US	low2.7	0.30% (22nd)	—	3.16.5	2025-12-05	3.0.0 → 3.16.5
CVE-2023-22472US	high8.8	0.21% (12th)	—	no fix	2023-01-09	= 3.6.1
CVE-2022-39334US	medium4.7	0.20% (10th)	—	3.6.1	2022-11-25	< 3.6.1
CVE-2025-47792US	medium6.1OT elevated	0.18% (8th)	—	3.15.0	2025-05-16	< 3.15.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-295Improper Certificate Validation5 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')4 CVEs
CWE-325Missing Cryptographic Step2 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer1 CVEs
CWE-209Generation of Error Message Containing Sensitive Information1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-276Incorrect Default Permissions1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE27 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan