Nextcloud Circles vulnerabilities

3 CVEs affecting Nextcloud Circles, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-37630, published 2021-09-07.

More from Nextcloud.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-37630, published 2021-09-07. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without…
• CVE-2021-32782, published 2021-09-07. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS)…
• CVE-2019-15610, published 2020-02-04. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.