6210 matches found
CVE-2026-67312 vulnerabilities
Vulnerabilities for packages: kibana, jitsucom-jitsu, azurite, semaphore, redisinsight, wazuh-dashboard-fips, prism, kubeflow-centraldashboard, gitlab-rails-ce, opensearch-dashboards, nextcloud-server, langfuse-fips, wazuh-dashboard, gitlab-rails-ce-fips, opensearch-dashboards-fips, arangodb,...
CVE-2026-67316 vulnerabilities
Vulnerabilities for packages: kibana, jitsucom-jitsu, azurite, semaphore, redisinsight, wazuh-dashboard-fips, prism, kubeflow-centraldashboard, gitlab-rails-ce, opensearch-dashboards, nextcloud-server, langfuse-fips, wazuh-dashboard, gitlab-rails-ce-fips, opensearch-dashboards-fips, arangodb,...
GHSA-F2R5-PQH9-R8F8 vulnerabilities
Vulnerabilities for packages: kibana, jitsucom-jitsu, azurite, semaphore, redisinsight, wazuh-dashboard-fips, prism, kubeflow-centraldashboard, gitlab-rails-ce, opensearch-dashboards, nextcloud-server, langfuse-fips, wazuh-dashboard, gitlab-rails-ce-fips, opensearch-dashboards-fips, arangodb,...
GHSA-4WW2-RJH2-XPV9 vulnerabilities
Vulnerabilities for packages: kibana, jitsucom-jitsu, azurite, semaphore, redisinsight, wazuh-dashboard-fips, prism, kubeflow-centraldashboard, gitlab-rails-ce, opensearch-dashboards, nextcloud-server, langfuse-fips, wazuh-dashboard, gitlab-rails-ce-fips, opensearch-dashboards-fips, arangodb,...
CVE-2026-67312 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu, kubeflow-centraldashboard, nextcloud-server, opensearch-dashboards, prism, lerna...
CVE-2026-67316 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu, kubeflow-centraldashboard, nextcloud-server, opensearch-dashboards, prism, lerna...
GHSA-4WW2-RJH2-XPV9 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu, kubeflow-centraldashboard, nextcloud-server, opensearch-dashboards, prism, lerna...
GHSA-F2R5-PQH9-R8F8 vulnerabilities
Vulnerabilities for packages: langfuse, jitsucom-jitsu, kubeflow-centraldashboard, nextcloud-server, opensearch-dashboards, prism, lerna...
CVE-2026-55640
creationtimestamp| type| source ---|---|--- 2026-08-25 18:08:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwfys2tk52p 2026-08-25 18:35:19+00:00| published-proof-of-concept| https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/GHSA-8vh3-g2qg-2h2c 2026-08-2...
CVE-2026-55640
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...
GHSA-8VH3-G2QG-2H2C nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...
EUVD-2026-65596
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
CVE-2026-55640
Nextcloud MCP Server prior to 0.117.2 contains an authentication bypass in the POST /webhooks/nextcloud endpoint. The WEBHOOK_SECRET defaults to None and startup validation does not enforce it, allowing unauthenticated requests to handle_nextcloud_webhook(). The payload["user"]["uid"] field is at...
CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
CVE-2026-55640
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
[SECURITY] Fedora 43 Update: nextcloud-34.0.3-1.fc43
NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...
[SECURITY] Fedora 44 Update: nextcloud-34.0.3-1.fc44
NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...