High, CVSS 8.7
LiteLLM allows a user to modify their own user_role via the /user/update endpoint
PyPI litellm · Upgrade to 1.83.10 or later · < 1.83.10 · CVE-2026-47102 · GHSA-wpfp-gwwc-vwq6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 77 matching · newest first
- High, CVSS 8.9
Concrete CMS Vulnerable to Deserialization of Untrusted Data
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-8135 · GHSA-pv2v-6w2v-97x6
- Medium, CVSS 6.9
Concrete CMS is vulnerable to unauthenticated file usage disclosure
Packagist concrete5/concrete5 · Upgrade to 9.5.1 or later · < 9.5.1 · CVE-2026-6826 · GHSA-4g7q-44qp-cc5c
- High, CVSS 8.7
LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
PyPI litellm · Upgrade to 1.83.14 or later · < 1.83.14 · CVE-2026-47101 · GHSA-qrc4-49gv-mv9m · amended
- Medium, CVSS 5.8
Twig:
{% sandbox %}{% include %}skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)Packagist twig/twig · Upgrade to 3.26.0 or later · < 3.26.0 · CVE-2026-46638 · GHSA-7fxw-r6jv-74c8
- Low, CVSS 1.3
Twig: HTML-output filters in twig/* extras incorrectly declared
is_safe => ['all']Packagist twig/cssinliner-extra +1 · Upgrade all 2 to 3.26.0 or later · < 3.26.0 · CVE-2026-46637 · GHSA-jv8m-2544-3pg3
- Low, CVSS 2.1
Twig: Sandbox property allowlist bypass via the
columnfilter (array_column on objects)Packagist twig/twig · Upgrade to 3.26.0 or later · < 3.26.0 · CVE-2026-46635 · GHSA-vcc8-phrv-43wj
- Unrated
Twig:
template_from_string()escapes a SourcePolicy-driven sandbox via synthesized template namePackagist twig/twig · Upgrade to 3.26.0 or later · >= 3.9.0, < 3.26.0 · CVE-2026-46634 · GHSA-24x9-r6q4-q93w
- Critical, CVSS 9.3
Twig: PHP code injection via
{% use %}template namePackagist twig/twig · Upgrade to 3.26.0 or later · >= 1.15.1, < 3.26.0 · CVE-2026-46633 · GHSA-7p85-w9px-jpjp · amended
- Low, CVSS 2.7
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments
Packagist twig/intl-extra · Upgrade to 3.26.0 or later · < 3.26.0 · CVE-2026-46629 · GHSA-35wc-cvqg-78fp
- Low, CVSS 1.3
Twig: The
spacelessfilter implicitly marks its output as safePackagist twig/twig · Upgrade to 3.26.0 or later · < 3.26.0 · CVE-2026-46628 · GHSA-4j38-f5cw-54h7
- High, CVSS 7.5
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
npm js-cookie · Upgrade to 3.0.7 or later · <= 3.0.5 · CVE-2026-46625 · GHSA-qjx8-664m-686j · amended
- High, CVSS 7.5
Russh: Unchecked CryptoVec allocation and growth handling is reachable
crates.io russh +1 · Upgrade all 2 to 0.60.3 or later · <= 0.60.2 · CVE-2026-46673 · GHSA-g9f8-wqj9-fjw5
- High, CVSS 8.7
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82855 · GHSA-59f3-7227-wmh4 · amended
- Critical, CVSS 9.3
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82856 · GHSA-q2f7-m237-v562 · amended
- High, CVSS 8.7
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82860 · GHSA-4xrh-5m3m-328w · amended
- High, CVSS 8.7
@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass
npm @hulumi/policies · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82861 · GHSA-g43v-9x7q-83pq · amended
- High, CVSS 8.7
@hulumi/drift: Orphan reconciler accepted externally supplied execute plans
npm @hulumi/drift · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82858 · GHSA-2ffm-hxrq-qqmm · amended
- Medium, CVSS 6.9
@hulumi/baseline: CloudTrail selector tampering events were not fully detected
npm @hulumi/baseline · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2026-82863 · GHSA-gfp8-mp24-5vxg · amended
- Medium, CVSS 4.6
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
NuGet umbraco.cms · Upgrade to 17.4.0 or later · >= 14.0.0, <= 17.3.5 · CVE-2026-46609 · GHSA-vr9v-27gg-qgx4
- High, CVSS 8.8
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
npm mcp-server-kubernetes · Upgrade to 3.6.0 or later · < 3.6.0 · CVE-2026-46519 · GHSA-cr22-wjx7-2w6m · amended
- Low, CVSS 2.3
SpiceDB: Caveat structures with nested lists can result in improper cache reuse
Go github.com/authzed/spicedb · Upgrade to 1.52.0 or later · >= 1.15.0, < 1.52.0 · CVE-2026-46668 · GHSA-mqcf-gqvg-rmhm
- High, CVSS 8.9
Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
crates.io p3-challenger · Upgrade to 0.5.3 or 0.4.3 by release line · < 0.4.3; >= 0.5.0, < 0.5.3 · CVE-2026-46654 · GHSA-vj64-rjf3-w3v7
- Medium, CVSS 6.9
Snappy : SSRF and local file read via the xsl-style-sheet option
Packagist knplabs/knp-snappy · Upgrade to 1.7.0 or later · <= 1.6.0 · CVE-2026-46683 · GHSA-c5fp-p67m-gq56
- Medium, CVSS 6.9
Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
Go github.com/fission/fission · Upgrade to 1.23.0 or later · <= 1.22.0 · CVE-2026-46618 · GHSA-7pjr-qpvh-m339
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.