5340 matches found
EUVD-2026-65596
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
CVE-2026-55640
Nextcloud MCP Server prior to 0.117.2 contains an authentication bypass in the POST /webhooks/nextcloud endpoint. The WEBHOOK_SECRET defaults to None and startup validation does not enforce it, allowing unauthenticated requests to handle_nextcloud_webhook(). The payload["user"]["uid"] field is at...
[SECURITY] Fedora 43 Update: nextcloud-34.0.3-1.fc43
NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...
[SECURITY] Fedora 44 Update: nextcloud-34.0.3-1.fc44
NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...
PT-2026-81391
Name of the Vulnerable Software and Affected Versions Nextcloud MCP Server versions prior to 0.117.2 Description The POST /webhooks/nextcloud endpoint lacks authentication by default because the WEBHOOK SECRET variable defaults to None and is not required during startup validation. When this secr...
Fedora 43 : nextcloud (2026-625cbe86c8)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-625cbe86c8 advisory. 34.0.3 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...
Fedora 44 : nextcloud (2026-a1368a72b4)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a1368a72b4 advisory. 34.0.3 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...
CVE-2026-55640: Missing Authentication for Critical Function
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...
GHSA-PCW8-M77R-2528 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
GHSA-PCW8-M77R-2528 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2026-73646 vulnerabilities
Vulnerabilities for packages: unleash, librechat, cadence-web, keep-fips, langfuse, unleash-fips, authentik-fips, keep, nextcloud-server, semaphore, gitlab-rails-ce, authentik, pelias-api, arangodb, langfuse-fips, gitlab-rails-ce-fips, homepage, jitsucom-jitsu, vitess...
CVE-2026-73646 vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu, vitess, langfuse, nextcloud-server...
GHSA-55Q2-FJHQ-7XH7 vulnerabilities
Vulnerabilities for packages: langfuse, nextcloud-server...
GHSA-38GX-CFQF-F652 vulnerabilities
Vulnerabilities for packages: redisinsight, librechat, nextcloud-server, kibana, kubeflow-centraldashboard, opensearch-dashboards-fips, wazuh-dashboard-fips, awx, jitsucom-jitsu, semaphore, wazuh-dashboard, langfuse, lerna, opensearch-dashboards, prism, langfuse-fips...
CVE-2026-67314 vulnerabilities
Vulnerabilities for packages: redisinsight, librechat, nextcloud-server, kibana, gitlab-rails-ce-fips, kubeflow-centraldashboard, opensearch-dashboards-fips, wazuh-dashboard-fips, awx, jitsucom-jitsu, semaphore, wazuh-dashboard, gitlab-rails-ce, langfuse, lerna, opensearch-dashboards, prism,...
GHSA-38GX-CFQF-F652 vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...
CVE-2026-67314 vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu, opensearch-dashboards, nextcloud-server, langfuse, lerna, prism, kubeflow-centraldashboard...
CVE-2026-69153 vulnerabilities
Vulnerabilities for packages: keep, nextcloud-server, saf, gitlab-rails-ce-fips, cadence-web, keep-fips, semaphore, renovate, gitlab-rails-ce, authentik, langfuse, kubeflow-pipelines, pelias-api, vitess, authentik-fips, arangodb, langfuse-fips...
GHSA-FXQJ-RQCC-2CMP vulnerabilities
Vulnerabilities for packages: keep, nextcloud-server, saf, gitlab-rails-ce-fips, cadence-web, keep-fips, semaphore, renovate, gitlab-rails-ce, authentik, langfuse, kubeflow-pipelines, pelias-api, vitess, authentik-fips, arangodb, langfuse-fips...