CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

EUVD-2026-65596

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

CVE-2026-55640

Nextcloud MCP Server prior to 0.117.2 contains an authentication bypass in the POST /webhooks/nextcloud endpoint. The WEBHOOK_SECRET defaults to None and startup validation does not enforce it, allowing unauthenticated requests to handle_nextcloud_webhook(). The payload["user"]["uid"] field is at...

[SECURITY] Fedora 43 Update: nextcloud-34.0.3-1.fc43

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

[SECURITY] Fedora 44 Update: nextcloud-34.0.3-1.fc44

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

PT-2026-81391

Name of the Vulnerable Software and Affected Versions Nextcloud MCP Server versions prior to 0.117.2 Description The POST /webhooks/nextcloud endpoint lacks authentication by default because the WEBHOOK SECRET variable defaults to None and is not required during startup validation. When this secr...

Fedora 43 : nextcloud (2026-625cbe86c8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-625cbe86c8 advisory. 34.0.3 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora 44 : nextcloud (2026-a1368a72b4)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a1368a72b4 advisory. 34.0.3 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

CVE-2026-55640: Missing Authentication for Critical Function

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

GHSA-PCW8-M77R-2528 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

GHSA-PCW8-M77R-2528 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

CVE-2026-73646 vulnerabilities

Vulnerabilities for packages: authentik, unleash-fips, arangodb, jitsucom-jitsu, langfuse, langfuse-fips, gitlab-rails-ce-fips, semaphore, gitlab-rails-ce, unleash, homepage, authentik-fips, cadence-web, vitess, nextcloud-server, pelias-api, keep, keep-fips, librechat...

CVE-2026-73646 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, jitsucom-jitsu, vitess...

GHSA-55Q2-FJHQ-7XH7 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server...

GHSA-38GX-CFQF-F652 vulnerabilities

Vulnerabilities for packages: prism, redisinsight, wazuh-dashboard-fips, jitsucom-jitsu, kubeflow-centraldashboard, langfuse, langfuse-fips, wazuh-dashboard, opensearch-dashboards-fips, lerna, opensearch-dashboards, kibana, librechat, nextcloud-server, awx, semaphore...

CVE-2026-67314 vulnerabilities

Vulnerabilities for packages: prism, gitlab-rails-ce, redisinsight, wazuh-dashboard-fips, jitsucom-jitsu, kubeflow-centraldashboard, langfuse, langfuse-fips, wazuh-dashboard, opensearch-dashboards-fips, gitlab-rails-ce-fips, lerna, opensearch-dashboards, kibana, librechat, nextcloud-server, awx,...

GHSA-38GX-CFQF-F652 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu, opensearch-dashboards, prism, kubeflow-centraldashboard, nextcloud-server, lerna...

CVE-2026-67314 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu, opensearch-dashboards, prism, kubeflow-centraldashboard, nextcloud-server, lerna...

CVE-2026-69153 vulnerabilities

Vulnerabilities for packages: renovate, authentik, gitlab-rails-ce, keep, arangodb, cadence-web, authentik-fips, langfuse, langfuse-fips, vitess, gitlab-rails-ce-fips, saf, kubeflow-pipelines, keep-fips, nextcloud-server, pelias-api, semaphore...

GHSA-FXQJ-RQCC-2CMP vulnerabilities

Vulnerabilities for packages: renovate, authentik, gitlab-rails-ce, keep, arangodb, cadence-web, authentik-fips, langfuse, langfuse-fips, vitess, gitlab-rails-ce-fips, saf, kubeflow-pipelines, keep-fips, nextcloud-server, pelias-api, semaphore...