5340 matches found
PoC---CVE-2023-26482-RCE-LAB-Nextcloud
Next cloud Proof of Concept & Analysis Security Notice This repository reproduces a publicly disclosed and patched vulnerability in a controlled Docker lab environment for educational and research purposes. The environment is intentionally vulnerable and must only be deployed in isolated test...
mailinabox
Mail-in-a-Box Por @JoshData y contribuidores. Mail-in-a-Box ayuda a las personas a recuperar el control de su correo electrĆ³nico definiendo un servidor SMTP+todo lo demĆ”s fĆ”cil de implementar con un solo clic: un servidor de correo en una caja. Por favor, consultahttps://mailinabox.email para ver...
CVE-2024-52510
Nextcloud X-E2EE-SIGNATURE Bypass POC Summary During normal operation of Nextcloud's E2EEv2 protocol, clients cryptographically sign folder-metadata before uploading to the server. This ensures the metadata has not been tampered with when it is re-fetched for the purposes of file-sharing or synci...
security-advisories
Security advisories This repository is the authoritative source for security advisories from the Nextcloud project: Advisories after May 2021 are published using GitHub's Security Advisory section Advisories before May 2021 can be found in the archived old/ folder as JSON files...
Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal
Windmill 1.603.3 contains a path traversal caused by unsanitized filename parameter in getlogfile endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication. id: CVE-2026-29059 info: name: Windmill/Nextcloud Flow 1.603.3 - Unauthenticated Pa...
CVE-2026-68493
A flaw was found in Nextcloud. A malicious logged-in user could potentially guess a highly complex unique identifier. This guessing could allow the user to retrieve a list of memberships for a circle they are not authorized to access, leading to information disclosure...
CVE-2026-77164
A flaw was found in Nextcloud. An unauthenticated remote attacker can exploit a Server-Side Request Forgery SSRF vulnerability in the Circles component. By sending a specially crafted request to the public endpoints, the attacker can force the server to make GET requests to internal network...
nextcloud_android
Nextcloud Android app Codacy Badge The Android client forNextcloud. Easily work with your data on your Nextcloud. How to contribute If you want to contribute to Nextcloud, you are very welcome: on our IRC channels and on freenode our forum at https://help.nextcloud.com for translations of the app...
CVE-2026-77165
creationtimestamp| type| source ---|---|--- 2026-09-22 12:15:04+00:00| seen| https://www.acn.gov.it/portale/w/nextcloud-poc-pubblica-per-lo-sfruttamento-della-cve-2026-77165 2026-09-23 01:00:43+00:00| seen|...
NcStatusCheck
NcStatusCheck Centralized monitoring for multiple Nextcloud instances NcStatusCheck is a monitoring tool that lets you track the health of multiple Nextcloud servers from a single web interface. It analyzes Nextcloud and PHP versions and provides update recommendations. šÆ Features Monitoring...
CVE-2026-45156-POC
Hacker Matrix Glitch šØ CVE-2026-45156 šØ Nextcloud useroidc ID4me JWT Signature Bypass Fully Automated Proof of Concept PoC Exploit for Admin Takeover. š The Story Behind every CVE, there's a story. This one was found at 2 AM on a cold winter night, fueled by a breakup mashup on loop. Read the ful...
CVE-2026-77164
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...
CVE-2026-77164
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...
CVE-2026-77164
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...
CVE-2026-77164
CVE-2026-77164 is a blind SSRF in Nextcloud's Circles app. During remote-instance signature verification, the server fetches an attacker-supplied keyId URL before trust is established and explicitly permits local/private addresses, bypassing Nextcloud's core SSRF protections. The vulnerable code ...
EUVD-2026-82621
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...
CVE-2026-77164: Server-Side Request Forgery (SSRF)
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
SummaryThe POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to Qdran...
PYSEC-2026-3866 nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...
GHSA-3MCP-22MF-VRW3 vulnerabilities
Vulnerabilities for packages: librechat, gitlab-rails-ce-fips, kubeflow-centraldashboard, jitsucom-jitsu, langfuse-fips, wazuh-dashboard, prism, azurite, opensearch-dashboards-fips, wazuh-dashboard-fips, langfuse, semaphore, gitlab-rails-ce, kibana, opensearch-dashboards, nextcloud-server, awx,...