Approved changes feed: RSS · Atom
cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Nextcloud (e5ae4298-6932-564f-a40d-08cebea039a5) |
|---|---|
| Product | Deck (303a4a3f-0c5f-5b20-b12d-bb61da800050) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nextcloud/deck |
purl2cpe | 2026-06-01 10:17:59.339486 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-77170 |
vulnerable | 2026-10-13 12:28:29.619989 |
Details available
MEDIUM (4.3)
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.
Published: 2026-09-18T01:26:04.640Z
Updated: 2026-09-18T19:41:31.474Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66557 |
vulnerable | 2026-06-08 07:41:19.173439 |
Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
MEDIUM (5.4)
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.
Published: 2025-12-05T17:28:48.642Z
Updated: 2025-12-08T20:12:45.372Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66548 |
vulnerable | 2026-06-08 07:41:19.162275 |
Nextcloud Deck app allows to spoof file extensions by using RTLO characters
LOW (3.3)
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.
Published: 2025-12-05T17:26:11.306Z
Updated: 2025-12-08T20:12:07.012Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37883 |
vulnerable | 2026-06-08 06:39:48.178859 |
Nextcloud Deck can access comments and attachments of deleted cards
MEDIUM (4.3)
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.
Published: 2024-06-14T15:33:18.525Z
Updated: 2024-08-02T03:57:39.902Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22213 |
vulnerable | 2026-06-08 06:29:34.147711 |
Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app
NONE
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.
Published: 2024-01-18T19:11:40.584Z
Updated: 2024-11-13T19:21:11.400Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-22471 |
vulnerable | 2026-06-08 05:54:26.389816 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-22470 |
vulnerable | 2026-06-08 05:54:26.389375 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-22469 |
vulnerable | 2026-06-08 05:54:26.388845 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29159 |
vulnerable | 2026-06-08 05:42:47.025500 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24906 |
vulnerable | 2026-06-08 05:41:44.871366 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39225 |
vulnerable | 2026-06-08 05:33:49.225437 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37631 |
vulnerable | 2026-06-08 05:32:54.518272 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22913 |
vulnerable | 2026-06-08 05:30:01.854437 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8297 |
vulnerable | 2026-06-08 05:27:15.567981 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8179 |
vulnerable | 2026-06-08 05:27:15.107633 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-15619 |
vulnerable | 2026-06-08 05:12:57.698724 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.