Nextcloud Notes vulnerabilities

2 CVEs affecting Nextcloud Notes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-37317, published 2024-06-14.

More from Nextcloud.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-39955, published 2023-08-10. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. Notes is a note-taking app for Nextcloud, an open-source cloud platform. Starting in version 4.4.0 and prior to version 4.8.0, when creating a note file with HTML, the content is rendered in the…
• CVE-2024-37317, published 2024-06-14. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app…