Approved changes feed: RSS · Atom
cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nextcloud (e5ae4298-6932-564f-a40d-08cebea039a5) |
|---|---|
| Product | Calendar (319c0b6e-da99-5681-8a21-629c2ea044cb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nextcloud/calendar |
purl2cpe | 2026-06-01 10:17:59.585617 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66550 |
vulnerable | 2026-06-08 07:41:19.164660 |
Nextcloud Calendar attachments of local files are offered to downloaded
MEDIUM (5.7)
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download link of a file on the same Nextcloud server, the file would be downloaded without the user confirming the action. This vulnerability is fixed in 4.7.17 and 5.2.4.
Published: 2025-12-05T16:56:44.680Z
Updated: 2025-12-05T18:41:24.347Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66546 |
vulnerable | 2026-06-08 07:41:19.152464 |
Nextcloud Calendar app allowed booking appointments without the generated token
LOW (3.3)
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.
Published: 2025-12-05T16:49:46.553Z
Updated: 2025-12-05T18:32:44.271Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66511 |
vulnerable | 2026-06-08 07:41:19.095343 | db.gcve.eu details are currently unavailable. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37316 |
vulnerable | 2026-06-08 06:39:47.134144 |
Nextcloud Calendar's event create can create attachments that link to other websites
MEDIUM (4.6)
Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2.
Published: 2024-06-14T15:23:12.705Z
Updated: 2024-08-02T03:50:56.106Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48308 |
vulnerable | 2026-06-08 06:14:26.849780 |
Calendar app returns full stacktrace when an error happens while editing appointment
LOW (3.5)
Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3
Published: 2023-12-21T23:12:45.538Z
Updated: 2024-11-27T15:46:01.287Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45150 |
vulnerable | 2026-06-08 06:12:42.063246 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-33183 |
vulnerable | 2026-06-08 06:06:21.936899 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24838 |
vulnerable | 2026-06-08 05:41:44.733318 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3763 |
vulnerable | 2026-06-08 05:11:41.253481 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.