{"uuid": "3636abdc-8140-4dca-b3d2-c307f74c55ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55640", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwvqbtp6j2y", "content": "CVE-2026-55640 - nextcloud-mcp-server\nThe webhook endpoint used by Nextcloud MCP does not require a secret by default, so anyone can send a POST request that tells the system to remove stored vector\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cbcoutinho #pip #CVE #infosec", "creation_timestamp": "2026-08-25T22:50:06.325953Z"}