- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/01/2026, owncloud recorded 5 security vulnerabilities in the last 90 days across 5 products, including 5 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, ownCloud 10 had the most security vulnerabilities in the owncloud ecosystem, with 4 vulnerabilities—approximately 80% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2025-53831DrawIO for ownCloud 10 is vulnerable to Stored XSS | Exploitation statusNot known exploited | FixNot confirmed | Affected productDrawIO for ownCloud | Published07/06/2026 | SeverityHigh |
CVE-2025-53830Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF) | Exploitation statusNot known exploited | FixNot confirmed | Affected productAnti-Virus for ownCloud | Published07/06/2026 | SeverityCritical |
CVE-2025-53829ownCloud 10 is vulnerable to Relative Path Traversal | Exploitation statusNot known exploited | FixNot confirmed | Affected productownCloud 10 | Published07/06/2026 | SeverityHigh |
CVE-2025-53828SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF) | Exploitation statusNot known exploited | FixNot confirmed | Affected productSharePoint | Published07/06/2026 | SeverityHigh |
CVE-2025-53827ownCloud Core: Updater has an exposed dangerous method or function | Exploitation statusNot known exploited | FixYes | Affected productownCloud Core | Published07/06/2026 | SeverityCritical |
CVE-2019-25337OwnCloud 8.1.8 - Username Disclosure | Exploitation statusPublic exploit | FixNot confirmed | Affected productowncloud | Published02/12/2026 | SeverityMedium |
CVE-2025-59716 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published11/05/2025 | SeverityMedium |
CVE-2024-50657 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published11/22/2024 | SeverityMedium |
CVE-2023-49104 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published11/21/2023 | SeverityHigh |
CVE-2023-49103 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published11/21/2023 | SeverityCritical |
CVE-2023-49105 | Exploitation statusKEV | FixNot confirmed | Affected productowncloud_server | Published11/21/2023 | SeverityCritical |
CVE-2023-23948ownCloud Android app vulnerable to SQL Injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productAndroid | Published02/13/2023 | SeverityMedium |
CVE-2023-24804ownCloud Android app vulnerable to Path Traversal | Exploitation statusPublic exploit | FixNot confirmed | Affected productAndroid | Published02/13/2023 | SeverityMedium |
CVE-2022-43679 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published11/10/2022 | SeverityMedium |
CVE-2022-31649 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/09/2022 | SeverityUnknown |
CVE-2022-25339 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/07/2022 | SeverityUnknown |
CVE-2022-25338 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/07/2022 | SeverityUnknown |
CVE-2021-33827 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/15/2022 | SeverityUnknown |
CVE-2021-33828 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/15/2022 | SeverityUnknown |
CVE-2021-44537 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/15/2022 | SeverityUnknown |
CVE-2021-40537 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/08/2021 | SeverityUnknown |
CVE-2021-35948 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/07/2021 | SeverityUnknown |
CVE-2021-35946 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/07/2021 | SeverityUnknown |
CVE-2021-35949 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/07/2021 | SeverityUnknown |
CVE-2021-35947 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/07/2021 | SeverityUnknown |
CVE-2021-29659 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/20/2021 | SeverityUnknown |
CVE-2020-28646 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/26/2021 | SeverityUnknown |
CVE-2020-36248 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/19/2021 | SeverityLow |
CVE-2020-36249 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/19/2021 | SeverityUnknown |
CVE-2020-36250 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/19/2021 | SeverityMedium |
CVE-2020-36251 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/19/2021 | SeverityLow |
CVE-2020-36252 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/19/2021 | SeverityMedium |
CVE-2020-10252 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/19/2021 | SeverityUnknown |
CVE-2020-10254 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/19/2021 | SeverityUnknown |
CVE-2020-28645 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2021 | SeverityUnknown |
CVE-2020-28644 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2021 | SeverityUnknown |
CVE-2020-16144 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2021 | SeverityUnknown |
CVE-2020-16255 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/15/2021 | SeverityUnknown |
CVE-2015-4715 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/17/2020 | SeverityUnknown |
CVE-2014-2052 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/11/2020 | SeverityUnknown |
CVE-2014-2050 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2020 | SeverityUnknown |
CVE-2013-0203 | Exploitation statusNot confirmed | FixNot confirmed | Affected productowncloud_server | Published11/22/2019 | SeverityUnknown |
CVE-2013-0202 | Exploitation statusNot confirmed | FixNot confirmed | Affected productowncloud | Published11/22/2019 | SeverityUnknown |
CVE-2014-2048 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/26/2018 | SeverityUnknown |
CVE-2014-1665 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published03/20/2018 | SeverityUnknown |
CVE-2017-8896 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/17/2017 | SeverityUnknown |
CVE-2017-9338 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/17/2017 | SeverityUnknown |
CVE-2017-9339 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/17/2017 | SeverityUnknown |
CVE-2017-9340 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/17/2017 | SeverityUnknown |
CVE-2016-9460 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 | Published03/28/2017 | SeverityUnknown |
CVE-2016-9459 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 | Published03/28/2017 | SeverityUnknown |
CVE-2016-9462 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 | Published03/28/2017 | SeverityUnknown |
CVE-2016-9463 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 | Published03/28/2017 | SeverityUnknown |
CVE-2016-9467 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 | Published03/28/2017 | SeverityUnknown |
CVE-2016-9466 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 | Published03/28/2017 | SeverityUnknown |
CVE-2016-9461 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 | Published03/28/2017 | SeverityUnknown |
CVE-2016-9468 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 | Published03/28/2017 | SeverityUnknown |
CVE-2016-9465 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 | Published03/28/2017 | SeverityUnknown |
CVE-2017-5867 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2017-5865 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2017-5866 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/03/2017 | SeverityUnknown |
CVE-2016-5876 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2017 | SeverityUnknown |
CVE-2016-7102 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2017 | SeverityUnknown |
CVE-2016-7419 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/17/2016 | SeverityUnknown |
CVE-2016-1500 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/08/2016 | SeverityUnknown |
CVE-2016-1498 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/08/2016 | SeverityUnknown |
CVE-2016-1499 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/08/2016 | SeverityUnknown |
CVE-2016-1501 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/08/2016 | SeverityUnknown |
CVE-2015-5955 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/29/2015 | SeverityUnknown |
CVE-2015-7699 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/26/2015 | SeverityUnknown |
CVE-2015-7298 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/26/2015 | SeverityUnknown |
CVE-2015-4456 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/26/2015 | SeverityUnknown |
CVE-2015-6500 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/26/2015 | SeverityUnknown |
CVE-2015-6670 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/26/2015 | SeverityUnknown |
CVE-2015-4716 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2015 | SeverityUnknown |
CVE-2015-4717 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2015 | SeverityUnknown |
CVE-2015-7698 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2015 | SeverityUnknown |
CVE-2015-5954 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2015 | SeverityUnknown |
CVE-2015-4718 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2015 | SeverityUnknown |
CVE-2015-5953 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2015 | SeverityUnknown |
CVE-2015-3011 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/08/2015 | SeverityUnknown |
CVE-2015-3013 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/08/2015 | SeverityUnknown |
CVE-2014-9044 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-9043 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-5341 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-9041 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-9046 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-9049 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-9042 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-9048 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-9045 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-9047 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/04/2015 | SeverityUnknown |
CVE-2014-2044 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published10/06/2014 | SeverityUnknown |
CVE-2014-4929 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/20/2014 | SeverityUnknown |
CVE-2013-0302 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/05/2014 | SeverityUnknown |
CVE-2013-0304 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/05/2014 | SeverityUnknown |
CVE-2014-2051 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/05/2014 | SeverityUnknown |
CVE-2013-1941 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/04/2014 | SeverityUnknown |
CVE-2014-3835 | Exploitation statusNot confirmed | FixNot confirmed | Affected productowncloud | Published06/04/2014 | SeverityUnknown |
CVE-2014-3834 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/04/2014 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan