https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:00:54.673080+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-nextcloud-2026-45690 BIT-nextcloud-2026-45690 — Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay 2026-10-03T14:00:54.676653+00:00

Affected: Bitnami: nextcloud

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a temporary session token before enforcing the second factor challenge. This token could be extracted and replayed via HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0583 certfr-2026-avi-0583 — De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Elles permettent à un attaquant de provoqu… 2026-10-03T14:00:54.676714+00:00 certfr-2026-avi-0583 https://cve.radiocsirt.org/vuln/euvd-2026-323827 EUVD-2026-323827 2026-10-03T14:00:54.676735+00:00 EUVD-2026-323827 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45690 fkie_cve-2026-45690 2026-10-03T14:00:54.676748+00:00

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a temporary session token before enforcing the second factor challenge. This token could be extracted and replayed via HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1773 WID-SEC-W-2026-1773 — Nextcloud: Mehrere Schwachstellen 2026-10-03T14:00:54.676773+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service zu verursachen und Informationen offenzulegen.