Apologies if this is a rookie question

That's not a rookie question at all, and actually shows you're paying attention to what you are deploying on your server.....which is what you should be doing. In addition to what others have said so far, images like Nextcloud are often updated quickly, but scans lag in reality. A critical label reflects known vulnerabilities in a version, but not necessarily 'this instance is definitely compromised.'