Nextcloud
C
CAUTION
94
Total CVEs
9
Crit / High
49
Medium
2%
Unpatched
79%
Patched
4.8
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB
How we collect data →
CVE Trend by Year
Patch Coverage
✓ 70 patched ✗ 2 unpatched ~ 16 under review ⏳ 1 pending score
Intelligence by Audience
PoC Available
1 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"nextcloud" port:443
org:"Nextcloud" http.status:200
Top EPSS (Exploitation Probability)
🎯 Bug Bounty Program: https://hackerone.com/nextcloud
Quick Facts for Reporting
Total CVEs tracked
94
Critical severity
1
Actively exploited (CISA)
0
Unpatched ratio
2%
Avg CVSS score
4.8
Security grade
C (CAUTION)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Security Risk Score (for investors)
LOW
Vuln Volume
GOOD
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
Security News Google News
Recent CVEs
showing 20 of 89
| CVE ID | Severity | Patch | EPSS | Date |
|---|---|---|---|---|
| CVE-2026-77164 | 6.2 MEDIUM | UNKNOWN / UNPATCHED | 0.13% | 2026-09-18 |
| CVE-2026-77169 | 6.5 MEDIUM | UNKNOWN / UNPATCHED | 0.24% | 2026-09-18 |
| CVE-2026-55640 | 9.1 CRITICAL | PATCH UNDER REVIEW | 0.48% | 2026-08-25 |
| CVE-2025-64011 PoC | ? N/A | UNKNOWN / UNPATCHED | 0.04% | 2025-12-12 |
| CVE-2025-66558 | 3.1 LOW | PATCHED / FIX AVAILABLE | 0.28% | 2025-12-05 |
| CVE-2025-66556 | 3.5 LOW | PATCHED / FIX AVAILABLE | 0.25% | 2025-12-05 |
| CVE-2025-66554 | 3.5 LOW | PATCHED / FIX AVAILABLE | 0.25% | 2025-12-05 |
| CVE-2025-66549 | 2.4 LOW | PATCHED / FIX AVAILABLE | 0.30% | 2025-12-05 |
| CVE-2025-66545 | 3.5 LOW | PATCHED / FIX AVAILABLE | 0.28% | 2025-12-05 |
| CVE-2025-66515 | 2.7 LOW | PATCHED / FIX AVAILABLE | 0.31% | 2025-12-05 |
| CVE-2025-66514 | 3.5 LOW | PATCHED / FIX AVAILABLE | 0.25% | 2025-12-05 |
| CVE-2025-66557 | 5.4 MEDIUM | PATCHED / FIX AVAILABLE | 0.28% | 2025-12-05 |
| CVE-2025-66548 | 3.3 LOW | PATCHED / FIX AVAILABLE | 0.15% | 2025-12-05 |
| CVE-2025-66553 | 4.3 MEDIUM | PATCHED / FIX AVAILABLE | 0.28% | 2025-12-05 |
| CVE-2025-66551 | 6.3 MEDIUM | PATCHED / FIX AVAILABLE | 0.25% | 2025-12-05 |
| CVE-2025-66513 | 4.3 MEDIUM | PATCHED / FIX AVAILABLE | 0.29% | 2025-12-05 |
| CVE-2025-66550 | 5.7 MEDIUM | PATCHED / FIX AVAILABLE | 0.34% | 2025-12-05 |
| CVE-2025-66546 | 3.3 LOW | PATCHED / FIX AVAILABLE | 0.14% | 2025-12-05 |
| CVE-2025-66511 | 4.8 MEDIUM | PATCHED / FIX AVAILABLE | 0.29% | 2025-12-05 |
| CVE-2025-66552 | 4.3 MEDIUM | PATCHED / FIX AVAILABLE | 0.31% | 2025-12-05 |
Intel
HQStuttgart, Germany
Founded2016
Employees100
CEOFrank Karlitschek
CountryGermany
LicenseOpen Source
Bug BountyView Program ↗
Trust ScoreC — CAUTION
Max CVSS9.7
Last Updated2026-08-03
Top Weaknesses
CWE-284
Improper Access Control
10 occurrences in Nextcloud CVEs
(11% of total)
CWE-639
Unknown Weakness Type
9 occurrences in Nextcloud CVEs
(10% of total)
CWE-200
Sensitive Information Exposure
9 occurrences in Nextcloud CVEs
(10% of total)
CWE-287
Improper Authentication
8 occurrences in Nextcloud CVEs
(9% of total)
CWE-862
Unknown Weakness Type
8 occurrences in Nextcloud CVEs
(9% of total)
CWE-79
Cross-Site Scripting (XSS)
5 occurrences in Nextcloud CVEs
(5% of total)
CWE-601
Open Redirect
4 occurrences in Nextcloud CVEs
(4% of total)
CWE-862 (Missing Authorization)
Unknown Weakness Type
3 occurrences in Nextcloud CVEs
(3% of total)
Company Profile
Nextcloud is a German open-source software company that provides self-hosted file sync and share, collaboration, and communication platforms. Its products are widely used by enterprises and public sector organizations for on-premises data storage and governance, making it a significant player in the secure collaboration and data sovereignty market. From a cybersecurity perspective, Nextcloud's focus on encryption, compliance, and integration with existing security infrastructure positions it as a key alternative to proprietary cloud services.
Response Metrics
Est. MTTR ⓘ
~64 days
(Average)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ → stable (+7%)
CVE count 2026 vs 2025:
27 → 29 CVEs
Patch Speed ⓘ Poor (>65% open)
2% of CVEs still unpatched.
Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
Financial Risk Estimate
Est. GDPR Low
€597K
Est. GDPR High
€6.0M
Based on 1 critical CVEs, 0 CISA KEV, 98% unpatched. Model: GDPR Art.83 · not legal advice.
Actions
Embed Badge
Nextcloud C valtersit.com