~/security / nextcloud
Nextcloud: latest vulnerabilities
The newest CVEs for Nextcloud, daily from the NVD. Descriptions come from the database.
| CVE | Published | Severity | Description |
|---|---|---|---|
| CVE-2026-110447 | 14 October 2026 | critical 9.2 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in … |
| CVE-2026-77164 | 18 September 2026 | medium 6.2 | Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public,… |
| CVE-2026-55640 | 25 August 2026 | critical 9.1 | Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHO… |
New articles by e-mail
One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).