High, CVSS 8.8
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
Packagist getkirby/cms · Upgrade to 5.4.1 or later · >= 5.3.0, <= 5.4.0 · CVE-2026-44177 · GHSA-9hx7-c53c-v6x8
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.5
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-44175 · GHSA-5fhx-9q32-q257
- High, CVSS 8.7
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
Packagist getkirby/cms · Upgrade to 5.4.1 or 4.9.1 by release line · <= 4.9.0; >= 5.0.0, <= 5.4.0 · CVE-2026-44174 · GHSA-86rh-h242-j8xp
- High, CVSS 8.9
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0, <= 1.3.0 · CVE-2026-43947 · GHSA-rg3m-cfq7-g6h6 · amended
- High, CVSS 7.7
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
npm fuxa-server · Upgrade to 1.3.1 or later · >= 1.3.0, <= 1.3.0 · CVE-2026-43946 · GHSA-fwcm-rqvw-j3p7 · amended
- High, CVSS 8.9
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
npm @frangoteam/fuxa · Upgrade to 1.3.1 or later · >= 1.2.11, < 1.3.1 · CVE-2026-43945 · GHSA-p69w-mmfv-xrfj · amended
- High, CVSS 7.0
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
npm @fedify/fedify · Upgrade to 2.2.3, 2.1.14, 2.0.18 or 2 more by release line · >= 2.2.0, < 2.2.3; >= 2.1.0, < 2.1.14; >= 2.0.0, < 2.0.18; >= 1.10.0, < 1.10.10; < 1.9.11 · CVE-2026-42462 · GHSA-9rfg-v8g9-9367 · amended
- High, CVSS 8.6
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
npm yeoman-environment · Upgrade to 6.0.1 or later · >= 2.9.0, < 6.0.1 · CVE-2026-42089 · GHSA-vv9j-gjw2-j8wp · amended
- High, CVSS 7.5
XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
Maven org.xwiki.platform:xwiki-platform-livetable-ui · Upgrade to 17.10.3, 17.4.9 or 16.10.17 by release line · >= 6.2.1, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0-rc-1, < 17.10.3 · CVE-2026-48048 · GHSA-rh28-mqj4-8x59
- Critical, CVSS 9.3
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
Maven org.xwiki.platform:xwiki-platform-rest-server · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.3, 17.4.9 or 16.10.17 by release line · >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-33137 · GHSA-qrvh-r3f2-9h4r
- High, CVSS 8.7
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
npm @typebot.io/js · Upgrade to 0.10.1 or later · < 0.10.1 · CVE-2026-28445 · GHSA-6m7c-xfhp-p9fh · amended
- Critical, CVSS 9.3
XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash
Maven org.xwiki.commons:xwiki-commons-classloader-api · Upgrade to 18.1.0-rc-1 (pre-release), 17.10.3, 17.4.9 or 16.10.17 by release line · >= 4.2-milestone-2, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1 · CVE-2026-23734 · GHSA-xq3r-2qv5-vqqm
- Critical, CVSS 9.9
KubeVirt has a Link Following vulnerability
Go kubevirt.io/kubevirt · Upgrade to 1.8.3, 1.7.4 or 1.6.6 by release line · >= 1.8.0-alpha.0, < 1.8.3; >= 1.7.0-alpha.0, < 1.7.4; < 1.6.6 · CVE-2026-7374 · GHSA-7jcp-v9w4-wjmg
- High, CVSS 7.7
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
npm pacote · Upgrade to 21.5.1 or later · >= 11.2.7, < 21.5.1 · CVE-2026-9496 · GHSA-w4pp-8pjf-rmxw · amended
- High, CVSS 7.2
Apache Syncope has an Improper Isolation or Compartmentalization vulnerability
Maven org.apache.syncope.core:syncope-core-spring · Upgrade to 4.1.1 or 4.0.6 by release line; some affected versions have no fix yet · >= 3.0.0-M0, <= 3.0.16; >= 4.0.0-M0, < 4.0.6; >= 4.1.0-M0, < 4.1.1 · CVE-2026-42782 · GHSA-gq7g-vg2q-jvq3
- High, CVSS 8.1
Apache Airflow providers-google's
ComputeEngineSSHHookdisables SSH host-key verification by defaultPyPI apache-airflow-providers-google · Upgrade to 22.0.0 or later · < 22.0.0 · CVE-2026-45361 · GHSA-g9v5-gjwf-9rwx · amended
- Critical, CVSS 9.0
MLflow allows unauthorized access to multipart upload endpoints when the
--serve-artifactsmode is enabledPyPI mlflow · Upgrade to 3.10.0 or later · < 3.10.0 · CVE-2026-2651 · GHSA-8c7q-86fq-vvmh · amended
- High, CVSS 7.8
HuggingFace transformers vulnerable to remote code execution
PyPI transformers · Upgrade to 5.3.0 or later · < 5.3.0 · CVE-2026-4372 · GHSA-29pf-2h5f-8g72 · amended
- Critical, CVSS 9.3
Dolibarr ERP CRM contains a remote code evaluation vulnerability
Packagist dolibarr/dolibarr · Upgrade to 7.0.4 or 6.0.8 by release line · >= 7.0.0, <= 7.0.3; < 6.0.8 · CVE-2018-25357 · GHSA-hxmh-2xc4-c894
- Critical, CVSS 9.8
Apache CXF has an LDAP injection vulnerability
Maven org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap · Upgrade to 4.2.1, 4.1.6 or 3.6.11 by release line · >= 4.2.0, <= 4.2.0; >= 4.1.0, < 4.1.6; < 3.6.11 · CVE-2026-44930 · GHSA-pg32-686q-qh6x
- High, CVSS 7.1
Mattermost doesn't validate file ownership and access control
Go github.com/mattermost/mattermost-server · Upgrade to 11.6.1, 11.5.4, 11.4.5 or 10.11.15 by release line · >= 11.6.0, <= 11.6.0; >= 11.5.0, < 11.5.4; >= 11.4.0, < 11.4.5; >= 10.11.0, < 10.11.15 · CVE-2026-3473 · GHSA-7pf2-9c95-w332
- High, CVSS 7.5
Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 8.0.0-20260410202636-17939826efa2 (pre-release) or later · < 8.0.0-20260410202636-17939826efa2 · +1 more package · CVE-2026-5740 · GHSA-w9m8-p4cc-4qj9
- High, CVSS 7.5
Mattermost doesn't enforce request body size limits on plugin HTTP endpoints
Go github.com/mattermost/mattermost-plugin-github · Upgrade to 1.0.1-0.20260410143745-9b41b1fd43c4 (pre-release) or later · < 1.0.1-0.20260410143745-9b41b1fd43c4 · +1 more package · CVE-2026-5308 · GHSA-jmvr-r5hm-fxfr
- High, CVSS 7.5
Apache CXF: Untrusted JMS configuration can lead to RCE
Maven org.apache.cxf:cxf-rt-transports-jms · Upgrade to 4.2.1, 4.1.6 or 3.6.11 by release line · >= 4.2.0, <= 4.2.0; >= 4.1.0, < 4.1.6; < 3.6.11 · CVE-2026-44417 · GHSA-2hvc-5c6v-f533
A vendor fix does not resolve your finding until you verify it in your own systems.