Approved changes feed: RSS · Atom
cpe:2.3:a:nextcloud:desktop:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nextcloud (e5ae4298-6932-564f-a40d-08cebea039a5) |
|---|---|
| Product | Desktop (0368ab89-d3e0-56b6-a2ff-771e95b5b666) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nextcloud/desktop |
purl2cpe | 2026-06-01 10:17:58.539584 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66549 |
vulnerable | 2026-06-08 07:41:19.164106 |
Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory
LOW (2.4)
Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files. This vulnerability is fixed in 3.16.5.
Published: 2025-12-05T17:47:00.748Z
Updated: 2025-12-08T19:54:01.534Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-47792 |
vulnerable | 2026-06-08 07:27:14.881328 |
Nextcloud Desktop 3rdparty applications can create share links via socket API
MEDIUM (5)
Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.
Published: 2025-05-16T14:13:53.209Z
Updated: 2025-05-16T14:27:53.727Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52510 |
vulnerable | 2026-06-08 06:52:15.331415 |
Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
MEDIUM (4.2)
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later.
Published: 2024-11-15T17:29:44.840Z
Updated: 2024-11-15T18:20:10.869Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46958 |
vulnerable | 2026-06-08 06:48:10.918806 |
Details available
In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.
Published: 2024-09-16T00:00:00.000Z
Updated: 2025-03-13T17:47:51.790Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37885 |
vulnerable | 2026-06-08 06:39:48.185962 |
Code injection in Nextcloud Desktop Client for macOS
LOW (3.8)
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0.
Published: 2024-06-14T15:42:42.132Z
Updated: 2024-08-02T03:57:39.894Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29000 |
vulnerable | 2026-06-08 06:02:37.894884 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28999 |
vulnerable | 2026-06-08 06:02:37.886891 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28998 |
vulnerable | 2026-06-08 06:02:37.886270 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28997 |
vulnerable | 2026-06-08 06:02:37.885561 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-23942 |
vulnerable | 2026-06-08 05:56:04.875689 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39334 |
vulnerable | 2026-06-08 05:47:18.615755 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39333 |
vulnerable | 2026-06-08 05:47:18.615217 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39332 |
vulnerable | 2026-06-08 05:47:18.614813 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39331 |
vulnerable | 2026-06-08 05:47:18.614249 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37617 |
vulnerable | 2026-06-08 05:32:54.481799 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32728 |
vulnerable | 2026-06-08 05:32:07.910534 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22895 |
vulnerable | 2026-06-08 05:30:01.796443 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22879 |
vulnerable | 2026-06-08 05:30:01.693258 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8230 |
vulnerable | 2026-06-08 05:27:15.327334 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8229 |
vulnerable | 2026-06-08 05:27:15.326912 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8227 |
vulnerable | 2026-06-08 05:27:15.323486 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8225 |
vulnerable | 2026-06-08 05:27:15.319687 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8224 |
vulnerable | 2026-06-08 05:27:15.319353 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8189 |
vulnerable | 2026-06-08 05:27:15.129347 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8140 |
vulnerable | 2026-06-08 05:27:14.948439 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.