Nextcloud Collectives vulnerabilities

Latest Nextcloud Collectives CVEs

Newest publication first

1. CVE-2026-77171 A public shared collective always allowed recipients of the link to create pages.

   Published 2026-10-27

   Low·CVSS 3.5 EPSS 0.17%

   A public shared collective always allowed recipients of the link to create pages.

2. CVE-2026-77166 The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

   Published 2026-09-21

   Low·CVSS 2.4 EPSS 0.28%

   The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.