cbcoutinho nextcloud-mcp-server

• CVE-2026-55640 Critical 9.1 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default ) 0.7%