GHSA-FQ2J-3J99-RX65 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

GHSA-9WX3-P993-35VP vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

CVE-2026-67313 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

GHSA-68JP-44VC-2X5H vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

CVE-2026-67320 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

CVE-2026-67312 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard-fips, awx, wazuh-dashboard, langfuse, redisinsight, nextcloud-server, kibana, kubeflow-centraldashboard, semaphore, gitlab-rails-ce, prism, arangodb, langfuse-fips, azurite, gitlab-rails-ce-fips, opensearch-dashboards-fips, jitsucom-jitsu,...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard-fips, awx, wazuh-dashboard, langfuse, redisinsight, nextcloud-server, kibana, kubeflow-centraldashboard, semaphore, gitlab-rails-ce, prism, arangodb, langfuse-fips, azurite, gitlab-rails-ce-fips, opensearch-dashboards-fips, jitsucom-jitsu,...

GHSA-4WW2-RJH2-XPV9 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard-fips, awx, wazuh-dashboard, langfuse, redisinsight, nextcloud-server, kibana, kubeflow-centraldashboard, semaphore, gitlab-rails-ce, prism, arangodb, langfuse-fips, azurite, gitlab-rails-ce-fips, opensearch-dashboards-fips, jitsucom-jitsu,...

CVE-2026-67316 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard-fips, awx, wazuh-dashboard, langfuse, redisinsight, nextcloud-server, kibana, kubeflow-centraldashboard, semaphore, gitlab-rails-ce, prism, arangodb, langfuse-fips, azurite, gitlab-rails-ce-fips, opensearch-dashboards-fips, jitsucom-jitsu,...

CVE-2026-67312 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

CVE-2026-67316 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

GHSA-4WW2-RJH2-XPV9 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...

CVE-2026-55640

creationtimestamp| type| source ---|---|--- 2026-08-25 18:08:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwfys2tk52p 2026-08-25 18:35:19+00:00| published-proof-of-concept| https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/GHSA-8vh3-g2qg-2h2c 2026-08-2...

CVE-2026-55640

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...

GHSA-8VH3-G2QG-2H2C nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...

CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...