Nextcloud Social — known CVE vulnerabilities

Every CVE whose affected-product data names Nextcloud Social, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2020-8279 — CVSS 7.4 (high): Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.
• CVE-2020-8278 — CVSS 5.3 (medium): Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.