#nextcloud

0 stories this week · 9 this month · 10 in 6 months · mostly security

Stories per day · 30 days

10 stories, newest first · one card per story

The guide scores Microsoft, Egnyte, Box, Nextcloud, Kiteworks and others on governance, encryption and deployment, not on a new incident.

Unauthenticated attackers can run OS commands as the web server user when the built-in CODE server is stopped; fix is 26.4.303.

FCEB agencies must patch command injection in Collabora CODE Server and SQL injection in on-prem VeloCloud Orchestrator by October 26.

Exploited2 min readcisa kev

Versions before 26.4.303 allow remote code execution when the built-in CODE server is not running.

The public site returns 404 unless the app itself confirms the share key; everything else stays on the VPN.

12 min readcaddy immich

Attackers are exploiting CVE-2026-110447 in Nextcloud's Collabora CODE app to plant web shells.

Exploited3 min readnextcloud collabora

GBHackers26d agohigh

Unauthenticated command injection CVE-2026-110447 in Nextcloud's built-in Collabora CODE Server can run commands as the web user.

Attackers are exploiting CVE-2026-110447 in Nextcloud's built-in Collabora app to plant webshells and hunt credentials.

Exploited3 min readnextcloud collabora

Attackers exploited CVE-2026-110447 in Nextcloud's optional Collabora CODE app to plant web shells.

Exploited6 min readnextcloud collabora

DeepSeek V4.1 Flash achieves 11/11 code executions on Enclave's AI hacking benchmark for $4.65 across Grafana, Jenkins, and Nextcloud targets.

Stories tagged #nextcloud