High, CVSS 8.1
shopper/framework: Authorization bypass in multiple Livewire admin components
Packagist shopper/framework · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2026-47740 · GHSA-f946-9qp6-vgch
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.9.0 or later · <= 0.31.8.0 · CVE-2026-45270 · GHSA-gqr2-7hcg-rchf
- High, CVSS 8.7
eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-j5rm-v3vh-vx94 · amended
- High, CVSS 7.1
eduMFA: Incorrect InnoDB snapshot isolation possibly allows token reusage
PyPI edumfa · Upgrade to 2.9.1 or later · < 2.9.1 · GHSA-qq2p-4282-cfc5 · amended
- High, CVSS 8.2
Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.0 or later · <= 1.18.1 · CVE-2026-45627 · GHSA-q2pj-8v84-9mh5
- Critical, CVSS 9.9
Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs
Go github.com/getarcaneapp/arcane/backend · Upgrade to 1.19.0 or later · <= 1.18.1 · CVE-2026-45625 · GHSA-7h26-hg47-p9hx
- High, CVSS 8.1
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
Go github.com/caddyserver/caddy/v2 · Upgrade to 2.11.3 or later · >= 2.7.0, <= 2.10.2 · CVE-2026-45135 · GHSA-m675-2p33-xv9g
- High, CVSS 7.2
Spring AI MCP Security: Unvalidated URL Fetching (SSRF)
Maven org.springaicommunity:mcp-client-security · Upgrade to 0.1.9 or later · < 0.1.9 · CVE-2026-45609 · GHSA-qjp4-4jvr-xqg3
- High, CVSS 8.2
form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys
npm form-data-objectizer · Upgrade to 1.0.1 or later · <= 1.0.0 · CVE-2026-46510 · GHSA-m2hg-wjq3-28wq · amended
- High, CVSS 7.8
Graphite Has a Pickle Deserialization Vulnerability
PyPI graphitedb · Upgrade to 0.2 or later · < 0.2 · GHSA-qw48-84f6-28gv · amended
- High, CVSS 7.4
Microsoft APM: Symlinks under
.apm/prompts/and.apm/agents/are dereferenced duringapm install, copying host-local file contents into the project treePyPI apm · Upgrade to 0.13.0 or later · >= 0.5.4, <= 0.12.4 · CVE-2026-45539 · GHSA-q5pp-gvjg-h7v4 · amended
- High, CVSS 8.7
Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 11.5.2, 11.4.4, 10.11.14 or 8.0.0-20260326202606-fac92f4a71f3 (pre-release) by release line · >= 11.5.0, < 11.5.2; >= 10.11.0, < 10.11.14; >= 11.4.0, < 11.4.4; < 8.0.0-20260326202606-fac92f4a71f3 · +1 more package · CVE-2026-6346 · GHSA-9p64-jpc7-m2rp
- High, CVSS 7.6
Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin
Go github.com/mattermost/mattermost-plugin-calls · Upgrade to 1.12.0-rc2 (pre-release) or later · < 1.12.0-rc2 · +1 more package · CVE-2026-6347 · GHSA-82j6-4fq7-fx62
A vendor fix does not resolve your finding until you verify it in your own systems.