CVE-2026-68493

A flaw was found in Nextcloud. A malicious logged-in user could potentially guess a highly complex unique identifier. This guessing could allow the user to retrieve a list of memberships for a circle they are not authorized to access, leading to information disclosure...

CVE-2026-77164

A flaw was found in Nextcloud. An unauthenticated remote attacker can exploit a Server-Side Request Forgery SSRF vulnerability in the Circles component. By sending a specially crafted request to the public endpoints, the attacker can force the server to make GET requests to internal network...

CVE-2026-77165

creationtimestamp| type| source ---|---|--- 2026-09-22 12:15:04+00:00| seen| https://www.acn.gov.it/portale/w/nextcloud-poc-pubblica-per-lo-sfruttamento-della-cve-2026-77165 2026-09-23 01:00:43+00:00| seen|...

CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

CVE-2026-77164

CVE-2026-77164 is a blind SSRF in Nextcloud's Circles app. During remote-instance signature verification, the server fetches an attacker-supplied keyId URL before trust is established and explicitly permits local/private addresses, bypassing Nextcloud's core SSRF protections. The vulnerable code ...

CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

EUVD-2026-82621

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

PT-2026-95209

Name of the Vulnerable Software and Affected Versions Nextcloud Team Folders affected versions not specified Description An issue exists in the team folders app previously known as group folders when integrated with the workspace app. This flaw allows delegated administrators with API/REST-only...

PT-2026-95208

Name of the Vulnerable Software and Affected Versions Nextcloud affected versions not specified Description Remote-instance signature verification in Circles fetches the keyId URL provided by an attacker before trust is established. This process explicitly allows local or private addresses,...

CVE-2026-77164: Server-Side Request Forgery (SSRF)

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

PT-2026-95211

Name of the Vulnerable Software and Affected Versions Nextcloud affected versions not specified Description An improper authorization issue exists in the DAV plugin where the system resolves files from the absolute request URI without verifying if the path segment matches the authenticated sessio...

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

SummaryThe POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to Qdran...

PYSEC-2026-3866 nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...

CVE-2026-67321 vulnerabilities

Vulnerabilities for packages: kibana, jitsucom-jitsu, azurite, semaphore, redisinsight, wazuh-dashboard-fips, prism, kubeflow-centraldashboard, gitlab-rails-ce, opensearch-dashboards, nextcloud-server, langfuse-fips, wazuh-dashboard, gitlab-rails-ce-fips, opensearch-dashboards-fips, langfuse, awx...

GHSA-3MCP-22MF-VRW3 vulnerabilities

Vulnerabilities for packages: kibana, jitsucom-jitsu, azurite, semaphore, redisinsight, wazuh-dashboard-fips, prism, kubeflow-centraldashboard, gitlab-rails-ce, opensearch-dashboards, nextcloud-server, langfuse-fips, wazuh-dashboard, gitlab-rails-ce-fips, opensearch-dashboards-fips, langfuse, awx...

GHSA-3MCP-22MF-VRW3 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu, kubeflow-centraldashboard, nextcloud-server, opensearch-dashboards, prism, lerna...

CVE-2026-67321 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu, kubeflow-centraldashboard, nextcloud-server, opensearch-dashboards, prism, lerna...

GHSA-5JGF-P345-68V8 vulnerabilities

Vulnerabilities for packages: kibana, keep, unleash, unleash-fips, vitess, keep-fips, wazuh-dashboard-fips, prism, yaml-language-server, tileserver-gl-fips, opensearch-dashboards, nextcloud-server, langfuse-fips, wazuh-dashboard, unleash-proxy, gitlab-rails-ce-fips, opensearch-dashboards-fips,...

GHSA-6HQM-HM2V-3P2P vulnerabilities

Vulnerabilities for packages: kibana, jitsucom-jitsu, azurite, semaphore, redisinsight, wazuh-dashboard-fips, prism, kubeflow-centraldashboard, gitlab-rails-ce, opensearch-dashboards, nextcloud-server, langfuse-fips, wazuh-dashboard, gitlab-rails-ce-fips, opensearch-dashboards-fips, langfuse, awx...