CVE-2026-67320 vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, opensearch-dashboards, lerna, jitsucom-jitsu, langfuse, nextcloud-server...

GHSA-9WX3-P993-35VP vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, opensearch-dashboards, lerna, jitsucom-jitsu, langfuse, nextcloud-server...

CVE-2026-67313 vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, opensearch-dashboards, lerna, jitsucom-jitsu, langfuse, nextcloud-server...

CVE-2026-67312 vulnerabilities

Vulnerabilities for packages: awx, gitlab-rails-ce-fips, lerna, jitsucom-jitsu, wazuh-dashboard, azurite, redisinsight, kubeflow-centraldashboard, prism, librechat, opensearch-dashboards, langfuse, langfuse-fips, arangodb, semaphore, wazuh-dashboard-fips, gitlab-rails-ce, kibana, nextcloud-server...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: awx, gitlab-rails-ce-fips, lerna, jitsucom-jitsu, wazuh-dashboard, azurite, redisinsight, kubeflow-centraldashboard, prism, librechat, opensearch-dashboards, langfuse, langfuse-fips, arangodb, semaphore, wazuh-dashboard-fips, gitlab-rails-ce, kibana, nextcloud-server...

GHSA-4WW2-RJH2-XPV9 vulnerabilities

Vulnerabilities for packages: awx, gitlab-rails-ce-fips, lerna, jitsucom-jitsu, wazuh-dashboard, azurite, redisinsight, kubeflow-centraldashboard, prism, librechat, opensearch-dashboards, langfuse, langfuse-fips, arangodb, semaphore, wazuh-dashboard-fips, gitlab-rails-ce, kibana, nextcloud-server...

CVE-2026-67316 vulnerabilities

Vulnerabilities for packages: awx, gitlab-rails-ce-fips, lerna, jitsucom-jitsu, wazuh-dashboard, azurite, redisinsight, kubeflow-centraldashboard, prism, librechat, opensearch-dashboards, langfuse, langfuse-fips, arangodb, semaphore, wazuh-dashboard-fips, gitlab-rails-ce, kibana, nextcloud-server...

CVE-2026-67316 vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, opensearch-dashboards, lerna, jitsucom-jitsu, langfuse, nextcloud-server...

CVE-2026-67312 vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, opensearch-dashboards, lerna, jitsucom-jitsu, langfuse, nextcloud-server...

GHSA-4WW2-RJH2-XPV9 vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, opensearch-dashboards, lerna, jitsucom-jitsu, langfuse, nextcloud-server...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, opensearch-dashboards, lerna, jitsucom-jitsu, langfuse, nextcloud-server...

CVE-2026-55640

creationtimestamp| type| source ---|---|--- 2026-08-25 18:08:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwfys2tk52p 2026-08-25 18:35:19+00:00| published-proof-of-concept| https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/GHSA-8vh3-g2qg-2h2c 2026-08-2...

CVE-2026-55640

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...

GHSA-8VH3-G2QG-2H2C nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...

CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

CVE-2026-55640

Nextcloud MCP Server prior to 0.117.2 contains an authentication bypass in the POST /webhooks/nextcloud endpoint. The WEBHOOK_SECRET defaults to None and startup validation does not enforce it, allowing unauthenticated requests to handle_nextcloud_webhook(). The payload["user"]["uid"] field is at...

EUVD-2026-65596

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...