nextcloud-mcp-server: Unauthenticated POST /webhooks/nextcloud allows arbitrary vector data deletion when WEBHOOK_SECRET is unset ( default )
PyPI nextcloud-mcp-server · Upgrade to 0.117.2 or later · <= 0.117.1 · CVE-2026-55640 · GHSA-8vh3-g2qg-2h2c · amended