https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-66514.htmlhttps://patchthecve.com/cve/CVE-2025-66514.htmlThu, 15 Oct 2026 21:10:00 +0000LOW 3.5: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextchttps://patchthecve.com/cve/CVE-2024-52509.htmlhttps://patchthecve.com/cve/CVE-2024-52509.htmlWed, 17 Jun 2026 08:07:21 +0000LOW 3.5: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. Ihttps://patchthecve.com/cve/CVE-2024-52508.htmlhttps://patchthecve.com/cve/CVE-2024-52508.htmlWed, 17 Jun 2026 08:07:21 +0000HIGH 8.2: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be https://patchthecve.com/cve/CVE-2023-48307.htmlhttps://patchthecve.com/cve/CVE-2023-48307.htmlWed, 17 Jun 2026 06:33:58 +0000LOW 3.5: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for thhttps://patchthecve.com/cve/CVE-2023-45660.htmlhttps://patchthecve.com/cve/CVE-2023-45660.htmlWed, 17 Jun 2026 06:29:02 +0000MEDIUM 4.3: Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. Thttps://patchthecve.com/cve/CVE-2023-33184.htmlhttps://patchthecve.com/cve/CVE-2023-33184.htmlWed, 17 Jun 2026 06:01:15 +0000LOW 3.5: Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3. https://patchthecve.com/cve/CVE-2023-25160.htmlhttps://patchthecve.com/cve/CVE-2023-25160.htmlWed, 17 Jun 2026 05:40:48 +0000MEDIUM 4.1: Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nexthttps://patchthecve.com/cve/CVE-2023-23943.htmlhttps://patchthecve.com/cve/CVE-2023-23943.htmlWed, 17 Jun 2026 05:38:20 +0000MEDIUM 5.0: Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgradhttps://patchthecve.com/cve/CVE-2023-23944.htmlhttps://patchthecve.com/cve/CVE-2023-23944.htmlWed, 17 Jun 2026 05:38:20 +0000LOW 2.0: Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwohttps://patchthecve.com/cve/CVE-2013-10001.htmlhttps://patchthecve.com/cve/CVE-2013-10001.htmlTue, 16 Jun 2026 23:50:30 +0000MEDIUM 4.8: A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certification validation of the mail client. An exploit has been disclosed to the public and may be used.https://patchthecve.com/cve/CVE-2021-39220.htmlhttps://patchthecve.com/cve/CVE-2021-39220.htmlWed, 17 Jun 2026 04:03:20 +0000LOW 3.5: Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended https://patchthecve.com/cve/CVE-2021-32707.htmlhttps://patchthecve.com/cve/CVE-2021-32707.htmlWed, 17 Jun 2026 03:53:28 +0000MEDIUM 4.3: Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute. Note that the images were still passed https://patchthecve.com/cve/CVE-2021-32652.htmlhttps://patchthecve.com/cve/CVE-2021-32652.htmlWed, 17 Jun 2026 03:53:21 +0000HIGH 8.8: Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the patchhttps://patchthecve.com/cve/CVE-2020-8156.htmlhttps://patchthecve.com/cve/CVE-2020-8156.htmlWed, 17 Jun 2026 03:25:57 +0000HIGH 7.0: A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.