https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-45810.htmlhttps://patchthecve.com/cve/CVE-2026-45810.htmlWed, 22 Jul 2026 08:10:00 +0000MEDIUM 6.8: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12, and 32.0.0 to before 32.0.3, a missing check of a relation allowed authenticated users with access to any file comment, to read the content of all comments. It is recommended that https://patchthecve.com/cve/CVE-2026-45691.htmlhttps://patchthecve.com/cve/CVE-2026-45691.htmlWed, 22 Jul 2026 08:10:00 +0000MEDIUM 5.9: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticatehttps://patchthecve.com/cve/CVE-2026-45690.htmlhttps://patchthecve.com/cve/CVE-2026-45690.htmlWed, 22 Jul 2026 08:10:00 +0000MEDIUM 5.9: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. https://patchthecve.com/cve/CVE-2026-45285.htmlhttps://patchthecve.com/cve/CVE-2026-45285.htmlWed, 22 Jul 2026 08:10:00 +0000MEDIUM 6.4: Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via email address who does not have a Nextcloud account), the syshttps://patchthecve.com/cve/CVE-2026-45283.htmlhttps://patchthecve.com/cve/CVE-2026-45283.htmlWed, 22 Jul 2026 07:10:00 +0000MEDIUM 6.3: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unhttps://patchthecve.com/cve/CVE-2026-45282.htmlhttps://patchthecve.com/cve/CVE-2026-45282.htmlWed, 22 Jul 2026 07:10:00 +0000MEDIUM 6.5: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download restrictionshttps://patchthecve.com/cve/CVE-2026-45281.htmlhttps://patchthecve.com/cve/CVE-2026-45281.htmlWed, 22 Jul 2026 07:10:00 +0000HIGH 8.1: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an attacker could possibly send a request to gain full access to their calendar. Therefore, the attackehttps://patchthecve.com/cve/CVE-2026-45279.htmlhttps://patchthecve.com/cve/CVE-2026-45279.htmlWed, 22 Jul 2026 07:10:00 +0000MEDIUM 4.4: Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into t