CISA ADP Vulnrichment

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Nextcloud/Server (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Nextcloud/Server.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 21, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 21, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 21, 2026

Sources and claim methodology

• Source referencehackerone.com

Related CVEs

• AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronizationSame generic ecosystem
• Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassemblySame generic ecosystem
• Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected EndpointSame generic ecosystem
• Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrlSame generic ecosystem
• Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on WindowsSame generic ecosystem
• Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherNameSame generic ecosystem