Nextcloud Calendar any version

Command Injection in Appointment Emails for Nextcloud Calendar

Calendar app returns full stacktrace when an error happens while editing appointment

Nextcloud Calendar app used predictable proposal participant tokens

Nextcloud Calendar attachments of local files are offered to downloaded

In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.

Nextcloud Calendar's event create can create attachments that link to other websites

Error in calendar when booking an appointment reveals the full path of the website

Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive

Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint

Nextcloud Calendar app allowed booking appointments without the generated token